# Flog Txt Version 1 # Analyzer Version: 4.4.1 # Analyzer Build Date: Jan 14 2022 06:06:11 # Log Creation Date: 23.04.2022 04:16:26.329 Process: id = "1" image_name = "a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" filename = "c:\\users\\keecfmwgj\\desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" page_root = "0x410e6000" os_pid = "0xeac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x788" cmd_line = "\"C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe\" " cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e746" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 116 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 117 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 118 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 119 start_va = 0x50000 end_va = 0x53fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 120 start_va = 0x140000 end_va = 0x17ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 121 start_va = 0x1d0000 end_va = 0x1ebfff monitored = 1 entry_point = 0x1dae1e region_type = mapped_file name = "a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe") Region: id = 122 start_va = 0x280000 end_va = 0x37ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 123 start_va = 0x76d60000 end_va = 0x76f08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 124 start_va = 0x76f40000 end_va = 0x770bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 125 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 126 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 127 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 128 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 129 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 130 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 131 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 270 start_va = 0xc0000 end_va = 0x13ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 271 start_va = 0x747c0000 end_va = 0x747c7fff monitored = 0 entry_point = 0x747c20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 272 start_va = 0x747d0000 end_va = 0x7482bfff monitored = 0 entry_point = 0x7480f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 273 start_va = 0x74830000 end_va = 0x7486efff monitored = 0 entry_point = 0x7485e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 274 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 275 start_va = 0x74da0000 end_va = 0x74eaffff monitored = 0 entry_point = 0x74db3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 276 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 277 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 278 start_va = 0x76b40000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76b5a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 279 start_va = 0x76b40000 end_va = 0x76c39fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b40000" filename = "" Region: id = 280 start_va = 0x380000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 281 start_va = 0x748e0000 end_va = 0x74929fff monitored = 1 entry_point = 0x748e2e54 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 282 start_va = 0x74da0000 end_va = 0x74eaffff monitored = 0 entry_point = 0x74db3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 283 start_va = 0x757b0000 end_va = 0x757f6fff monitored = 0 entry_point = 0x757b74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 284 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 285 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 286 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 287 start_va = 0x1f0000 end_va = 0x256fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 288 start_va = 0x4e0000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 289 start_va = 0x4e0000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 290 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 291 start_va = 0x74fa0000 end_va = 0x7503ffff monitored = 0 entry_point = 0x74fb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 292 start_va = 0x75a50000 end_va = 0x75afbfff monitored = 0 entry_point = 0x75a5a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 293 start_va = 0x74af0000 end_va = 0x74b08fff monitored = 0 entry_point = 0x74af4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 294 start_va = 0x74eb0000 end_va = 0x74f9ffff monitored = 0 entry_point = 0x74ec0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 295 start_va = 0x74a90000 end_va = 0x74aeffff monitored = 0 entry_point = 0x74aaa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 296 start_va = 0x74a80000 end_va = 0x74a8bfff monitored = 0 entry_point = 0x74a810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 297 start_va = 0x630000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 298 start_va = 0x720d0000 end_va = 0x7215cfff monitored = 1 entry_point = 0x720e2860 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 299 start_va = 0x72ab0000 end_va = 0x72ab2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "api-ms-win-core-synch-l1-2-0.dll" filename = "\\Windows\\SysWOW64\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\windows\\syswow64\\api-ms-win-core-synch-l1-2-0.dll") Region: id = 300 start_va = 0x759f0000 end_va = 0x75a46fff monitored = 0 entry_point = 0x75a09ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 301 start_va = 0x75960000 end_va = 0x759effff monitored = 0 entry_point = 0x75976343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 302 start_va = 0x74c80000 end_va = 0x74d7ffff monitored = 0 entry_point = 0x74c9b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 303 start_va = 0x74c50000 end_va = 0x74c59fff monitored = 0 entry_point = 0x74c536a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 304 start_va = 0x75640000 end_va = 0x756dcfff monitored = 0 entry_point = 0x75673fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 305 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 306 start_va = 0x740000 end_va = 0x8c7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000740000" filename = "" Region: id = 307 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 308 start_va = 0x75500000 end_va = 0x7555ffff monitored = 0 entry_point = 0x7551158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 309 start_va = 0x756e0000 end_va = 0x757abfff monitored = 0 entry_point = 0x756e168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 310 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 311 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 312 start_va = 0x8d0000 end_va = 0xa50fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008d0000" filename = "" Region: id = 313 start_va = 0xa60000 end_va = 0x1e5ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a60000" filename = "" Region: id = 314 start_va = 0x60000 end_va = 0x77fff monitored = 1 entry_point = 0x6ae1e region_type = mapped_file name = "a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe") Region: id = 315 start_va = 0x60000 end_va = 0x77fff monitored = 1 entry_point = 0x6ae1e region_type = mapped_file name = "a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe") Region: id = 316 start_va = 0x73a90000 end_va = 0x73a98fff monitored = 0 entry_point = 0x73a91220 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 317 start_va = 0x71b20000 end_va = 0x720cafff monitored = 1 entry_point = 0x71b73dc0 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 318 start_va = 0x71570000 end_va = 0x71b1afff monitored = 1 entry_point = 0x715c3dc0 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 319 start_va = 0x1e60000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 320 start_va = 0x71b20000 end_va = 0x720cafff monitored = 1 entry_point = 0x71b73dc0 region_type = mapped_file name = "mscorwks.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorwks.dll") Region: id = 321 start_va = 0x60000 end_va = 0x60fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 322 start_va = 0x71a80000 end_va = 0x71b1afff monitored = 0 entry_point = 0x71a8232b region_type = mapped_file name = "msvcr80.dll" filename = "\\Windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.6195_none_d09154e044272b9a\\msvcr80.dll") Region: id = 323 start_va = 0x1e60000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 324 start_va = 0x2040000 end_va = 0x207ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002040000" filename = "" Region: id = 325 start_va = 0x70000 end_va = 0x70fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 326 start_va = 0x80000 end_va = 0x80fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 327 start_va = 0x90000 end_va = 0x9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 328 start_va = 0xa0000 end_va = 0xaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000a0000" filename = "" Region: id = 329 start_va = 0xb0000 end_va = 0xbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 330 start_va = 0x180000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 331 start_va = 0x190000 end_va = 0x19ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 332 start_va = 0x1a0000 end_va = 0x1affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 333 start_va = 0x390000 end_va = 0x3cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 334 start_va = 0x3e0000 end_va = 0x4dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003e0000" filename = "" Region: id = 335 start_va = 0x1f20000 end_va = 0x201ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 336 start_va = 0x2020000 end_va = 0x202ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 337 start_va = 0x7efd8000 end_va = 0x7efdafff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 338 start_va = 0x75ec0000 end_va = 0x76b09fff monitored = 0 entry_point = 0x75f41601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 339 start_va = 0x1b0000 end_va = 0x1b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001b0000" filename = "" Region: id = 340 start_va = 0x75800000 end_va = 0x7595bfff monitored = 0 entry_point = 0x7584ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 341 start_va = 0x2080000 end_va = 0x234efff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 342 start_va = 0x73b50000 end_va = 0x73b5afff monitored = 0 entry_point = 0x73b51992 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll") Region: id = 343 start_va = 0x1c0000 end_va = 0x1cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 344 start_va = 0x2350000 end_va = 0x434ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002350000" filename = "" Region: id = 345 start_va = 0x630000 end_va = 0x6cffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000630000" filename = "" Region: id = 346 start_va = 0x730000 end_va = 0x73ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000730000" filename = "" Region: id = 347 start_va = 0x43e0000 end_va = 0x441ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043e0000" filename = "" Region: id = 348 start_va = 0x45b0000 end_va = 0x46affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000045b0000" filename = "" Region: id = 349 start_va = 0x7efd5000 end_va = 0x7efd7fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 350 start_va = 0x70f80000 end_va = 0x71a77fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll") Region: id = 351 start_va = 0x73960000 end_va = 0x739dffff monitored = 0 entry_point = 0x739737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 352 start_va = 0x1e60000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e60000" filename = "" Region: id = 353 start_va = 0x4420000 end_va = 0x44fefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004420000" filename = "" Region: id = 354 start_va = 0x1c0000 end_va = 0x1c2fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "l_intl.nls" filename = "\\Windows\\SysWOW64\\l_intl.nls" (normalized: "c:\\windows\\syswow64\\l_intl.nls") Region: id = 355 start_va = 0x260000 end_va = 0x26ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 356 start_va = 0x4e0000 end_va = 0x4f7fff monitored = 1 entry_point = 0x4eae1e region_type = mapped_file name = "a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" filename = "\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe" (normalized: "c:\\users\\keecfmwgj\\desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe") Region: id = 357 start_va = 0x560000 end_va = 0x59ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 358 start_va = 0x74880000 end_va = 0x748dafff monitored = 1 entry_point = 0x748c4d48 region_type = mapped_file name = "mscorjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\mscorjit.dll") Region: id = 359 start_va = 0x270000 end_va = 0x270fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000270000" filename = "" Region: id = 360 start_va = 0x380000 end_va = 0x38ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000380000" filename = "" Region: id = 361 start_va = 0x3d0000 end_va = 0x3dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 362 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 363 start_va = 0x4f0000 end_va = 0x4f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 364 start_va = 0x4e0000 end_va = 0x4e0fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll" filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll") Region: id = 365 start_va = 0x4f0000 end_va = 0x4f6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "tzres.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui") Region: id = 366 start_va = 0x707e0000 end_va = 0x70f7bfff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System\\9e0a3b9b9f457233a335d7fba8f95419\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system\\9e0a3b9b9f457233a335d7fba8f95419\\system.ni.dll") Region: id = 367 start_va = 0x70640000 end_va = 0x707dafff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\Microsoft.VisualBas#\\08d608378aa405adc844f3cf36974b8c\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\microsoft.visualbas#\\08d608378aa405adc844f3cf36974b8c\\microsoft.visualbasic.ni.dll") Region: id = 368 start_va = 0x75e30000 end_va = 0x75ebefff monitored = 0 entry_point = 0x75e33fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 369 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 370 start_va = 0x4e0000 end_va = 0x4effff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 371 start_va = 0x4f0000 end_va = 0x4fffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 372 start_va = 0x500000 end_va = 0x50ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 373 start_va = 0x4e0000 end_va = 0x4e4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sorttbls.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp") Region: id = 374 start_va = 0x4f0000 end_va = 0x530fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "sortkey.nlp" filename = "\\Windows\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp" (normalized: "c:\\windows\\assembly\\gac_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp") Region: id = 375 start_va = 0x704b0000 end_va = 0x70637fff monitored = 1 entry_point = 0x0 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v2.0.50727_32\\System.Drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v2.0.50727_32\\system.drawing\\dbfe8642a8ed7b2b103ad28e0c96418a\\system.drawing.ni.dll") Region: id = 417 start_va = 0x4350000 end_va = 0x438ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004350000" filename = "" Region: id = 418 start_va = 0x48a0000 end_va = 0x499ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000048a0000" filename = "" Region: id = 419 start_va = 0x7efad000 end_va = 0x7efaffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 420 start_va = 0x6d0000 end_va = 0x70ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 421 start_va = 0x4a10000 end_va = 0x4b0ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004a10000" filename = "" Region: id = 422 start_va = 0x7efaa000 end_va = 0x7efacfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 424 start_va = 0x43a0000 end_va = 0x43dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000043a0000" filename = "" Region: id = 425 start_va = 0x46e0000 end_va = 0x47dffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000046e0000" filename = "" Region: id = 426 start_va = 0x73810000 end_va = 0x73826fff monitored = 0 entry_point = 0x73813573 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 427 start_va = 0x7efa7000 end_va = 0x7efa9fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 428 start_va = 0x5a0000 end_va = 0x5dbfff monitored = 0 entry_point = 0x5a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 429 start_va = 0x5a0000 end_va = 0x5dbfff monitored = 0 entry_point = 0x5a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 430 start_va = 0x5a0000 end_va = 0x5dbfff monitored = 0 entry_point = 0x5a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 431 start_va = 0x5a0000 end_va = 0x5dbfff monitored = 0 entry_point = 0x5a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 432 start_va = 0x5a0000 end_va = 0x5dbfff monitored = 0 entry_point = 0x5a128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 433 start_va = 0x737d0000 end_va = 0x7380afff monitored = 0 entry_point = 0x737d128d region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 434 start_va = 0x73950000 end_va = 0x7395dfff monitored = 0 entry_point = 0x73951235 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Region: id = 450 start_va = 0x4570000 end_va = 0x45affff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004570000" filename = "" Region: id = 451 start_va = 0x4cc0000 end_va = 0x4dbffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004cc0000" filename = "" Region: id = 452 start_va = 0x7efa4000 end_va = 0x7efa6fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 453 start_va = 0x1e80000 end_va = 0x1ebffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001e80000" filename = "" Region: id = 454 start_va = 0x1ec0000 end_va = 0x1efffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 455 start_va = 0x4ed0000 end_va = 0x4fcffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000004ed0000" filename = "" Region: id = 456 start_va = 0x7efa1000 end_va = 0x7efa3fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Thread: id = 1 os_tid = 0xeb0 [0062.822] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x3fae60, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0xfb8, lpName="Global\\Cor_Private_IPCBlock_3756") returned 0x88 [0062.825] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x3faed8, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x134, lpName="Global\\Cor_Public_IPCBlock_3756") returned 0x90 [0067.297] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0067.853] GetVersionExW (in: lpVersionInformation=0x420328*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x420328*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0067.853] GetLastError () returned 0x0 [0067.854] GetVersionExW (in: lpVersionInformation=0x420328*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x420328*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0067.854] GetLastError () returned 0x0 [0067.855] CreateFileMappingW (hFile=0x188, lpFileMappingAttributes=0x37ed24, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x18c [0067.863] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\", nBufferLength=0x105, lpBuffer=0x37ec38, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\", lpFilePart=0x0) returned 0x1b [0067.863] GetLastError () returned 0x0 [0067.941] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe", nBufferLength=0x105, lpBuffer=0x37eca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe", lpFilePart=0x0) returned 0x5f [0067.941] GetLastError () returned 0x2 [0067.948] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe", nBufferLength=0x105, lpBuffer=0x37ec3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe", lpFilePart=0x0) returned 0x5f [0067.948] GetLastError () returned 0x2 [0067.955] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\", nBufferLength=0x105, lpBuffer=0x37ec04, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\", lpFilePart=0x0) returned 0x1b [0067.955] GetLastError () returned 0x2 [0067.967] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\", nBufferLength=0x105, lpBuffer=0x37eca0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\", lpFilePart=0x0) returned 0x1b [0067.967] GetLastError () returned 0x2 [0067.967] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\", nBufferLength=0x105, lpBuffer=0x37ec3c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\", lpFilePart=0x0) returned 0x1b [0067.967] GetLastError () returned 0x2 [0067.967] CreateFileMappingW (hFile=0x188, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x18c [0071.652] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.653] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.664] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.664] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.664] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.664] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.664] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.664] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.664] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.665] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.666] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.667] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.668] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.669] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x0 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x1 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.670] VarDecCmp (pdecLeft=0x37f25c, pdecRight=0x37f24c) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.913] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.914] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x1 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.915] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.921] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0071.926] GetProcAddress (hModule=0x74da0000, lpProcName="GetModuleHandleA") returned 0x74db1245 [0071.969] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe", nBufferLength=0x105, lpBuffer=0x37ecbc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe", lpFilePart=0x0) returned 0x5f [0071.969] GetLastError () returned 0x7e [0071.969] GetModuleHandleA (lpModuleName="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe") returned 0x1d0000 [0071.969] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.969] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.969] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.969] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.970] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.971] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x1 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.972] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.972] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0071.972] GetProcAddress (hModule=0x74da0000, lpProcName="FindResourceA") returned 0x74dce98b [0071.986] FindResourceA (hModule=0x1d0000, lpName="2yullp4o", lpType="RC_IMAGE") returned 0x1de0f0 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.986] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.987] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.988] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.989] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x1 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0071.990] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0071.991] GetProcAddress (hModule=0x74da0000, lpProcName="SizeofResource") returned 0x74db5a81 [0072.005] SizeofResource (hModule=0x1d0000, hResInfo=0x1de0f0) returned 0xac00 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.006] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x0 [0072.007] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.008] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x1 [0072.008] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.008] VarDecCmp (pdecLeft=0x37f094, pdecRight=0x37f084) returned 0x2 [0072.008] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0072.008] GetProcAddress (hModule=0x74da0000, lpProcName="LoadResource") returned 0x74db5904 [0072.021] LoadResource (hModule=0x1d0000, hResInfo=0x1de0f0) returned 0x1de154 [0072.260] GetFullPathNameW (in: lpFileName="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe", nBufferLength=0x105, lpBuffer=0x37e9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\kEecfMwgj\\Desktop\\a4fb180f23ce8454febb54cea71c28dedecb09823bee87b65aec3e144c7ad844.exe", lpFilePart=0x0) returned 0x5f [0072.260] GetLastError () returned 0x7e [0072.265] GetSystemDirectoryW (in: lpBuffer=0x422280, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0072.265] GetLastError () returned 0x7e [0072.265] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x37e9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0072.265] GetLastError () returned 0x7e [0072.265] GetFullPathNameW (in: lpFileName="C:\\Program Files (x86)", nBufferLength=0x105, lpBuffer=0x37ea24, lpFilePart=0x0 | out: lpBuffer="C:\\Program Files (x86)", lpFilePart=0x0) returned 0x16 [0072.266] GetLastError () returned 0x7e [0072.267] GetVersionExW (in: lpVersionInformation=0x422298*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x422298*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1 [0072.267] GetLastError () returned 0x7e [0072.268] SetErrorMode (uMode=0x1) returned 0x0 [0072.270] GetFileAttributesExW (in: lpFileName="C:\\Program Files (x86)" (normalized: "c:\\program files (x86)"), fInfoLevelId=0x0, lpFileInformation=0x37eea4 | out: lpFileInformation=0x37eea4*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x499a3700, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x499a3700, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x1000)) returned 1 [0072.270] GetLastError () returned 0x7e [0072.270] SetErrorMode (uMode=0x0) returned 0x1 [0072.270] GetSystemDirectoryW (in: lpBuffer=0x422280, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0072.270] GetLastError () returned 0x7e [0072.270] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x105, lpBuffer=0x37e9c8, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x0) returned 0x13 [0072.270] GetLastError () returned 0x7e [0072.300] CreateFileMappingW (hFile=0x198, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x19c [0072.312] CreateFileMappingW (hFile=0x1a0, lpFileMappingAttributes=0x0, flProtect=0x2, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x0, lpName=0x0) returned 0x1a4 [0072.319] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework", nBufferLength=0x105, lpBuffer=0x37e97c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework", lpFilePart=0x0) returned 0x22 [0072.319] GetLastError () returned 0x0 [0072.322] SetErrorMode (uMode=0x1) returned 0x0 [0072.327] FindFirstFileW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\*", lpFindFileData=0x4222b0 | out: lpFindFileData=0x4222b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6707650, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xf6707650, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x430878 [0072.327] GetLastError () returned 0x0 [0072.329] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe6f339c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf6707650, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xf6707650, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.329] GetLastError () returned 0x0 [0072.329] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8478e267, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8478e267, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x847b43c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x15350, dwReserved0=0x0, dwReserved1=0x0, cFileName="NETFXSBS10.exe", cAlternateFileName="")) returned 1 [0072.329] GetLastError () returned 0x0 [0072.329] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0025282, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xf2125e24, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf214bf85, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="netfxsbs12.hkf", cAlternateFileName="NETFXS~1.HKF")) returned 1 [0072.329] GetLastError () returned 0x0 [0072.329] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf665e3a2, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf665e3a2, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9525d89c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbscmp10.dll", cAlternateFileName="")) returned 1 [0072.329] GetLastError () returned 0x0 [0072.330] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66d07bf, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf66d07bf, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9538e39c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbscmp20_mscorwks.dll", cAlternateFileName="")) returned 1 [0072.330] GetLastError () returned 0x0 [0072.344] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f691e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf66f691e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x953b44fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbscmp20_perfcounter.dll", cAlternateFileName="")) returned 1 [0072.344] GetLastError () returned 0x0 [0072.344] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf627fffc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf627fffc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94d74b3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_diasymreader.dll", cAlternateFileName="")) returned 1 [0072.344] GetLastError () returned 0x0 [0072.345] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf62cc2ba, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf62cc2ba, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94d74b3c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_iehost.dll", cAlternateFileName="")) returned 1 [0072.345] GetLastError () returned 0x0 [0072.345] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6318578, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf6318578, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94d9ac9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_microsoft.jscript.dll", cAlternateFileName="")) returned 1 [0072.345] GetLastError () returned 0x0 [0072.345] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6364836, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf6364836, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94d9ac9c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_microsoft.vsa.vb.codedomprocessor.dll", cAlternateFileName="")) returned 1 [0072.345] GetLastError () returned 0x0 [0072.345] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf63b0af4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf63b0af4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94dc0dfc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_mscordbi.dll", cAlternateFileName="")) returned 1 [0072.345] GetLastError () returned 0x0 [0072.346] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6422f11, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf6422f11, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94de6f5c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_mscorrc.dll", cAlternateFileName="")) returned 1 [0072.346] GetLastError () returned 0x0 [0072.346] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf646f1cf, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf646f1cf, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94de6f5c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_mscorsec.dll", cAlternateFileName="")) returned 1 [0072.346] GetLastError () returned 0x0 [0072.346] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf64bb48d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf64bb48d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94e0d0bc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b70, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_system.configuration.install.dll", cAlternateFileName="")) returned 1 [0072.346] GetLastError () returned 0x0 [0072.346] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650774b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf650774b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94e3321c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b50, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_system.data.dll", cAlternateFileName="")) returned 1 [0072.346] GetLastError () returned 0x0 [0072.347] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6553a09, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf6553a09, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94e3321c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_system.enterpriseservices.dll", cAlternateFileName="")) returned 1 [0072.347] GetLastError () returned 0x0 [0072.347] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf659fcc7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf659fcc7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94e5937c, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_VsaVb7rt.dll", cAlternateFileName="")) returned 1 [0072.347] GetLastError () returned 0x0 [0072.348] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf65ebf85, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf65ebf85, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x94e7f4dc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbs_wminet_utils.dll", cAlternateFileName="")) returned 1 [0072.348] GetLastError () returned 0x0 [0072.348] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6768d3b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0xf6768d3b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x953b44fc, ftLastWriteTime.dwHighDateTime=0x1c9ea11, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedReg12.dll", cAlternateFileName="")) returned 1 [0072.348] GetLastError () returned 0x0 [0072.348] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7194f6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8fc7e9ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x8fc7e9ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0.3705", cAlternateFileName="V10~1.370")) returned 1 [0072.348] GetLastError () returned 0x0 [0072.348] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7194f6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfeb1d974, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfeb1d974, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.1.4322", cAlternateFileName="V11~1.432")) returned 1 [0072.348] GetLastError () returned 0x0 [0072.349] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfe7194f6, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8aaa82d0, ftLastAccessTime.dwHighDateTime=0x1d70913, ftLastWriteTime.dwLowDateTime=0x8aaa82d0, ftLastWriteTime.dwHighDateTime=0x1d70913, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v2.0.50727", cAlternateFileName="V20~1.507")) returned 1 [0072.349] GetLastError () returned 0x0 [0072.349] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0072.349] GetLastError () returned 0x0 [0072.349] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x920f1acf, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x920f1acf, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0072.349] GetLastError () returned 0x0 [0072.349] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6707650, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x8bea1920, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x8bea1920, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v4.0.30319", cAlternateFileName="V40~1.303")) returned 1 [0072.349] GetLastError () returned 0x0 [0072.350] FindNextFileW (in: hFindFile=0x430878, lpFindFileData=0x422298 | out: lpFindFileData=0x422298*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6707650, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x8bea1920, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x8bea1920, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v4.0.30319", cAlternateFileName="V40~1.303")) returned 0 [0072.350] GetLastError () returned 0x12 [0072.350] FindClose (in: hFindFile=0x430878 | out: hFindFile=0x430878) returned 1 [0072.352] SetErrorMode (uMode=0x0) returned 0x1 [0072.468] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.468] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.468] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.469] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.470] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x1 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.471] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.471] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0072.471] GetProcAddress (hModule=0x74da0000, lpProcName="CreateProcessA") returned 0x74db1072 [0072.485] CreateProcessA (in: lpApplicationName=0x0, lpCommandLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2363768*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2363474 | out: lpCommandLine="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe", lpProcessInformation=0x2363474*(hProcess=0x1ac, hThread=0x1a8, dwProcessId=0xee4, dwThreadId=0xee8)) returned 1 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.500] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.501] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.502] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.503] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.503] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.503] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.503] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x1 [0072.503] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.503] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.503] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0072.503] GetProcAddress (hModule=0x74da0000, lpProcName="GetThreadContext") returned 0x74dd799c [0072.719] GetThreadContext (in: hThread=0x1a8, lpContext=0x2363774 | out: lpContext=0x2363774*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x404d61, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0072.725] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.725] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.725] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.725] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.725] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.726] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.727] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x1 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.728] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0072.729] GetProcAddress (hModule=0x74da0000, lpProcName="ReadProcessMemory") returned 0x74dccfa4 [0072.746] ReadProcessMemory (in: hProcess=0x1ac, lpBaseAddress=0x7efde008, lpBuffer=0x37f220, nSize=0x4, lpNumberOfBytesRead=0x37f228 | out: lpBuffer=0x37f220*, lpNumberOfBytesRead=0x37f228*=0x4) returned 1 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.746] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.747] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.748] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.749] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.749] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x1 [0072.749] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.749] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.749] GetModuleHandleA (lpModuleName="ntdll") returned 0x76f40000 [0072.749] GetProcAddress (hModule=0x76f40000, lpProcName="NtUnmapViewOfSection") returned 0x76f5fc70 [0072.766] NtUnmapViewOfSection (ProcessHandle=0x1ac, BaseAddress=0x400000) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.769] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.770] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.771] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.772] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x1 [0072.772] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.772] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.772] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0072.772] GetProcAddress (hModule=0x74da0000, lpProcName="VirtualAllocEx") returned 0x74dcd980 [0072.786] VirtualAllocEx (hProcess=0x1ac, lpAddress=0x400000, dwSize=0x22000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0072.787] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.787] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.787] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.787] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.788] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.789] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x1 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.790] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0072.791] GetProcAddress (hModule=0x74da0000, lpProcName="WriteProcessMemory") returned 0x74dcd9b0 [0072.805] WriteProcessMemory (in: hProcess=0x1ac, lpBaseAddress=0x400000, lpBuffer=0x235501c*, nSize=0x1000, lpNumberOfBytesWritten=0x37f228 | out: lpBuffer=0x235501c*, lpNumberOfBytesWritten=0x37f228*=0x1000) returned 1 [0072.819] WriteProcessMemory (in: hProcess=0x1ac, lpBaseAddress=0x401000, lpBuffer=0x236496c, nSize=0x0, lpNumberOfBytesWritten=0x37f228 | out: lpNumberOfBytesWritten=0x37f228) returned 0 [0072.820] WriteProcessMemory (in: hProcess=0x1ac, lpBaseAddress=0x417000, lpBuffer=0x2364ebc*, nSize=0x9a00, lpNumberOfBytesWritten=0x37f228 | out: lpBuffer=0x2364ebc*, lpNumberOfBytesWritten=0x37f228*=0x9a00) returned 1 [0072.827] WriteProcessMemory (in: hProcess=0x1ac, lpBaseAddress=0x421000, lpBuffer=0x236e8e0*, nSize=0xe00, lpNumberOfBytesWritten=0x37f228 | out: lpBuffer=0x236e8e0*, lpNumberOfBytesWritten=0x37f228*=0xe00) returned 1 [0072.856] WriteProcessMemory (in: hProcess=0x1ac, lpBaseAddress=0x7efde008, lpBuffer=0x236f710*, nSize=0x4, lpNumberOfBytesWritten=0x37f228 | out: lpBuffer=0x236f710*, lpNumberOfBytesWritten=0x37f228*=0x4) returned 1 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.856] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.857] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x1 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.858] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.859] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0072.859] GetProcAddress (hModule=0x74da0000, lpProcName="SetThreadContext") returned 0x74e35933 [0072.859] SetThreadContext (hThread=0x1a8, lpContext=0x2363774*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x420730, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.860] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.861] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x0 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x1 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] VarDecCmp (pdecLeft=0x37eda0, pdecRight=0x37ed90) returned 0x2 [0072.862] GetModuleHandleA (lpModuleName="kernel32") returned 0x74da0000 [0072.863] GetProcAddress (hModule=0x74da0000, lpProcName="ResumeThread") returned 0x74db43a7 [0072.896] ResumeThread (hThread=0x1a8) returned 0x1 [0072.939] CoGetContextToken (in: pToken=0x37fd4c | out: pToken=0x37fd4c) returned 0x0 [0072.939] CObjectContext::QueryInterface () returned 0x0 [0072.939] CObjectContext::GetCurrentThreadType () returned 0x0 [0072.939] Release () returned 0x0 [0072.940] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x3f4120*=0x9c, lpdwindex=0x37fbb8 | out: lpdwindex=0x37fbb8) returned 0x0 Thread: id = 2 os_tid = 0xec0 Thread: id = 3 os_tid = 0xec4 [0067.822] CoGetContextToken (in: pToken=0x46af9c8 | out: pToken=0x46af9c8) returned 0x800401f0 [0067.822] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 5 os_tid = 0xeec Thread: id = 6 os_tid = 0xef0 Thread: id = 7 os_tid = 0xef4 Thread: id = 8 os_tid = 0xef8 Thread: id = 9 os_tid = 0xefc Process: id = "2" image_name = "cvtres.exe" filename = "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\cvtres.exe" page_root = "0x3f572000" os_pid = "0xee4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xeac" cmd_line = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" cur_dir = "C:\\Users\\kEecfMwgj\\Desktop\\" os_username = "Q9IATRKPRH\\kEecfMwgj" bitness = "32" os_groups = "Q9IATRKPRH\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e746" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 376 start_va = 0x10000 end_va = 0x2ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 377 start_va = 0x30000 end_va = 0x31fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 378 start_va = 0x40000 end_va = 0x40fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 379 start_va = 0x50000 end_va = 0x8ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000050000" filename = "" Region: id = 380 start_va = 0x90000 end_va = 0x18ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 381 start_va = 0x190000 end_va = 0x193fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000190000" filename = "" Region: id = 382 start_va = 0x1a0000 end_va = 0x1a0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001a0000" filename = "" Region: id = 383 start_va = 0x400000 end_va = 0x409fff monitored = 0 entry_point = 0x404d61 region_type = mapped_file name = "cvtres.exe" filename = "\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\cvtres.exe") Region: id = 384 start_va = 0x76d60000 end_va = 0x76f08fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 385 start_va = 0x76f40000 end_va = 0x770bffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 386 start_va = 0x7efb0000 end_va = 0x7efd2fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 387 start_va = 0x7efdb000 end_va = 0x7efddfff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 388 start_va = 0x7efde000 end_va = 0x7efdefff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 389 start_va = 0x7efdf000 end_va = 0x7efdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 390 start_va = 0x7efe0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 391 start_va = 0x7ffe0000 end_va = 0x7ffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 392 start_va = 0x7fff0000 end_va = 0x7fffffeffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 393 start_va = 0x400000 end_va = 0x421fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 394 start_va = 0x1c0000 end_va = 0x23ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 395 start_va = 0x747c0000 end_va = 0x747c7fff monitored = 0 entry_point = 0x747c20f8 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 396 start_va = 0x747d0000 end_va = 0x7482bfff monitored = 0 entry_point = 0x7480f9f4 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 397 start_va = 0x74830000 end_va = 0x7486efff monitored = 0 entry_point = 0x7485e088 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 398 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 399 start_va = 0x74da0000 end_va = 0x74eaffff monitored = 0 entry_point = 0x74db3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 400 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 0 entry_point = 0x76c55340 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 401 start_va = 0x76c40000 end_va = 0x76d5efff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076c40000" filename = "" Region: id = 402 start_va = 0x76b40000 end_va = 0x76c39fff monitored = 0 entry_point = 0x76b5a2c8 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 403 start_va = 0x76b40000 end_va = 0x76c39fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000076b40000" filename = "" Region: id = 404 start_va = 0x240000 end_va = 0x34ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000240000" filename = "" Region: id = 405 start_va = 0x74da0000 end_va = 0x74eaffff monitored = 0 entry_point = 0x74db3283 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 406 start_va = 0x757b0000 end_va = 0x757f6fff monitored = 0 entry_point = 0x757b74c1 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 407 start_va = 0x10000 end_va = 0x1ffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 408 start_va = 0x7efe0000 end_va = 0x7f0dffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 409 start_va = 0x7f0e0000 end_va = 0x7ffdffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 410 start_va = 0x350000 end_va = 0x3b6fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 411 start_va = 0x74fa0000 end_va = 0x7503ffff monitored = 0 entry_point = 0x74fb49e5 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 412 start_va = 0x75a50000 end_va = 0x75afbfff monitored = 0 entry_point = 0x75a5a472 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 413 start_va = 0x74af0000 end_va = 0x74b08fff monitored = 0 entry_point = 0x74af4975 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 414 start_va = 0x74eb0000 end_va = 0x74f9ffff monitored = 0 entry_point = 0x74ec0569 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 415 start_va = 0x74a90000 end_va = 0x74aeffff monitored = 0 entry_point = 0x74aaa3b3 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 416 start_va = 0x74a80000 end_va = 0x74a8bfff monitored = 0 entry_point = 0x74a810e1 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 423 start_va = 0x72160000 end_va = 0x721e3fff monitored = 0 entry_point = 0x721619a9 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\\comctl32.dll") Region: id = 435 start_va = 0x75960000 end_va = 0x759effff monitored = 0 entry_point = 0x75976343 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 436 start_va = 0x74c80000 end_va = 0x74d7ffff monitored = 0 entry_point = 0x74c9b6ed region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 437 start_va = 0x74c50000 end_va = 0x74c59fff monitored = 0 entry_point = 0x74c536a0 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 438 start_va = 0x75640000 end_va = 0x756dcfff monitored = 0 entry_point = 0x75673fd7 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 439 start_va = 0x75e30000 end_va = 0x75ebefff monitored = 0 entry_point = 0x75e33fb1 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 440 start_va = 0x75800000 end_va = 0x7595bfff monitored = 0 entry_point = 0x7584ba3d region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 441 start_va = 0x75ec0000 end_va = 0x76b09fff monitored = 0 entry_point = 0x75f41601 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 442 start_va = 0x759f0000 end_va = 0x75a46fff monitored = 0 entry_point = 0x75a09ba6 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 443 start_va = 0x430000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000430000" filename = "" Region: id = 444 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 445 start_va = 0x430000 end_va = 0x5b7fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000430000" filename = "" Region: id = 446 start_va = 0x620000 end_va = 0x62ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 447 start_va = 0x20000 end_va = 0x3dfff monitored = 0 entry_point = 0x3158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 448 start_va = 0x75500000 end_va = 0x7555ffff monitored = 0 entry_point = 0x7551158f region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 449 start_va = 0x756e0000 end_va = 0x757abfff monitored = 0 entry_point = 0x756e168b region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 457 start_va = 0x20000 end_va = 0x20fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 458 start_va = 0x30000 end_va = 0x30fff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 459 start_va = 0x630000 end_va = 0x7b0fff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 460 start_va = 0x7c0000 end_va = 0x1bbffff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000007c0000" filename = "" Region: id = 461 start_va = 0x1bc0000 end_va = 0x1c3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001bc0000" filename = "" Region: id = 462 start_va = 0x1c40000 end_va = 0x1d3ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001c40000" filename = "" Region: id = 463 start_va = 0x73960000 end_va = 0x739dffff monitored = 0 entry_point = 0x739737c9 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 464 start_va = 0x1d40000 end_va = 0x1deffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001d40000" filename = "" Region: id = 465 start_va = 0x1df0000 end_va = 0x1ecefff monitored = 1 entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001df0000" filename = "" Region: id = 466 start_va = 0x73930000 end_va = 0x73942fff monitored = 0 entry_point = 0x73931d3f region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll") Region: id = 467 start_va = 0x1ed0000 end_va = 0x205ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000001ed0000" filename = "" Region: id = 468 start_va = 0x2060000 end_va = 0x298ffff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 469 start_va = 0x1b0000 end_va = 0x1b4fff monitored = 0 entry_point = 0x0 region_type = mapped_file name = "user32.dll.mui" filename = "\\Windows\\SysWOW64\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\user32.dll.mui") Region: id = 470 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 471 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 472 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 473 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 474 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 475 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 476 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 477 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 478 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 479 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 480 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 481 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 482 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 483 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 484 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 485 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 486 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 487 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 488 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 489 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 490 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 491 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 492 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 493 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 494 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 495 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 496 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 497 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 498 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 499 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 500 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 501 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 502 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 503 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 504 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 505 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 506 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 507 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 508 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 509 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 510 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 511 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 512 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 513 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 514 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 515 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 516 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 517 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 518 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 519 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 520 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 521 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 522 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 523 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 524 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 525 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 526 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 527 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 528 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 529 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 530 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 531 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 532 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 533 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 534 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 535 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 536 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 537 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 538 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 539 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 540 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 541 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 542 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 543 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 544 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 545 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 546 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 547 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 548 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 549 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 550 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 551 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 552 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 553 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 554 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 555 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 556 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 557 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 558 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 559 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 560 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 561 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 562 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 563 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 564 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 565 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 566 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 567 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 568 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 569 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 570 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 571 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 572 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 573 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 574 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 575 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 576 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 577 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 578 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 579 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 580 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 581 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 582 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 583 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 584 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 585 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 586 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 587 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 588 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 589 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 590 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 591 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 592 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 593 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 594 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 595 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 596 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 597 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 598 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 599 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 600 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 601 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 602 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 603 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 604 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 605 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 606 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 607 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 608 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 609 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 610 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 611 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 612 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 613 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 614 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 615 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 616 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 617 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 618 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 619 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 620 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 621 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 622 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 623 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 624 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 625 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 626 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 627 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 628 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 629 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 630 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 631 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 632 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 633 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 634 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 635 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 636 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 637 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 638 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 639 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 640 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 641 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 642 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 643 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 644 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 645 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 646 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 647 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 648 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 649 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 650 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 651 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 652 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 653 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 654 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 655 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 656 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 657 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 658 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 659 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 660 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 661 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 662 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 663 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 664 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 665 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 666 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 667 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 668 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 669 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 670 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 671 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 672 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 673 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 674 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 675 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 676 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 677 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 678 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 679 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 680 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 681 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 682 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 683 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 684 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 685 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 686 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 687 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 688 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 689 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 690 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 691 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 692 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 693 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 694 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 695 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 696 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 697 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 698 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 699 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 700 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 701 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 702 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 703 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 704 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 705 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 706 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 707 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 708 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 709 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 710 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 711 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 712 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 713 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 714 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 715 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 716 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 717 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 718 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 719 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 720 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 721 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 722 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 723 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 724 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 725 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 726 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 727 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 728 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 729 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 730 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 731 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 732 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 733 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 734 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 735 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 736 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 737 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 738 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 739 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 740 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 741 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 742 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 743 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 744 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 745 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 746 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 747 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 748 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 749 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 750 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 751 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 752 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 753 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 754 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 755 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 756 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 757 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 758 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 759 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 760 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 761 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 762 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 763 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 764 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 765 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 766 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 767 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 768 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 769 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 770 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 771 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 772 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 773 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 774 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 775 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 776 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 777 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 778 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 779 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 780 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 781 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 782 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 783 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 784 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 785 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 786 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 787 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 788 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 789 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 790 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 791 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 792 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 793 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 794 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 795 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 796 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 797 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 798 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 799 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 800 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 801 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 802 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 803 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 804 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 805 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 806 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 807 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 808 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 809 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 810 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 811 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 812 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 813 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 814 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 815 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 816 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 817 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 818 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 819 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 820 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 821 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 822 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 823 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 824 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 825 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 826 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 827 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 828 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 829 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 830 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 831 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 832 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 833 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 834 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 835 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 836 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 837 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 838 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 839 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 840 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 841 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 842 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 843 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 844 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 845 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 846 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 847 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 848 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 849 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 850 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 851 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 852 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 853 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 854 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 855 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 856 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 857 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 858 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 859 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 860 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 861 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 862 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 863 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 864 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 865 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 866 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 867 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 868 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 869 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 870 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 871 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 872 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 873 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 874 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 875 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 876 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 877 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 878 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 879 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 880 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 881 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 882 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 883 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 884 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 885 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 886 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 887 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 888 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 889 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 890 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 891 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 892 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 893 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 894 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 895 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 896 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 897 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 898 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 899 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 900 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 901 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 902 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 903 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 904 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 905 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 906 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 907 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 908 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 909 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 910 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 911 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 912 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 913 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 914 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 915 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 916 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 917 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 918 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 919 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 920 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 921 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 922 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 923 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 924 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 925 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 926 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 927 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 928 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 929 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 930 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 931 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 932 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 933 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 934 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 935 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 936 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 937 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 938 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 939 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 940 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 941 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 942 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 943 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 944 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 945 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 946 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 947 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 948 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 949 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 950 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 951 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 952 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 953 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 954 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 955 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 956 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 957 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 958 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 959 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 960 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 961 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 962 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 963 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 964 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 965 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 966 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 967 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 968 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 969 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 970 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 971 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 972 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 973 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 974 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 975 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 976 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 977 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 978 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 979 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 980 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 981 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 982 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 983 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 984 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 985 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 986 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 987 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 988 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 989 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 990 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 991 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 992 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 993 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 994 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 995 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 996 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 997 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 998 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 999 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1000 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1001 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1002 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1003 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1004 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1005 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1006 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1007 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1008 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1009 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1010 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1011 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1016 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1017 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1018 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1019 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1020 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1021 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1022 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1023 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1024 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1025 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1026 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1027 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1028 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1029 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1030 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1031 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1032 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1033 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1034 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1035 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1036 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1037 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1038 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1039 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1040 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1041 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1042 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1043 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1044 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1045 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1046 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1047 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1048 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1049 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1050 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1051 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1052 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1053 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1054 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1055 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1056 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1057 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1058 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1059 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1060 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1061 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1062 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1063 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1064 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1065 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1066 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1067 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1068 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1069 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1070 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1071 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1072 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1073 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1074 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1075 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1076 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1077 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1078 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1079 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1080 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1081 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1082 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1083 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1084 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1085 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1086 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1087 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1088 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1089 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1090 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1091 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1092 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1093 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1094 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1095 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1096 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1097 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1098 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1099 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1100 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1101 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1102 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1103 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1104 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1105 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1106 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1107 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1108 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1109 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1110 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1111 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1112 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1113 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1114 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1115 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1116 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1117 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1118 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1119 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1120 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1121 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1122 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1123 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1124 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1125 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1126 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1127 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1128 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1129 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1130 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1131 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1132 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1133 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1134 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1135 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1136 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1137 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1138 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1139 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1140 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1141 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1142 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1143 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1144 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1145 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1146 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1147 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1148 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1149 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1150 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1151 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1152 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1153 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1154 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1155 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1156 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1157 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1158 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1159 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1160 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1161 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1162 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1163 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1164 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1165 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1166 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1167 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1168 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1169 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1170 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1171 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1172 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1173 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1174 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1175 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1176 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1177 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1178 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1179 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1180 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1181 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1182 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1183 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1184 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1185 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1186 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1187 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1188 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1189 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1190 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1191 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1192 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1193 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1194 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1195 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1196 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1197 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1198 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1199 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1200 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1201 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1202 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1203 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1204 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1205 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1206 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1207 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1208 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1209 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1210 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1211 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1212 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1213 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1214 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1215 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1216 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1217 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1218 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1219 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1220 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1221 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1222 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1223 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1224 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1225 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1226 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1227 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1228 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1229 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1230 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1231 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1232 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1233 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1234 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1235 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1236 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1237 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1238 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1239 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1240 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1241 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1242 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1243 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1244 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1245 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1246 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1247 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1248 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1249 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1250 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1251 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1252 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1253 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1254 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1255 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1256 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1257 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1258 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1259 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1260 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1261 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1262 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1263 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1264 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1265 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1266 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1267 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1268 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1269 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1270 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1271 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1272 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1273 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1274 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1275 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1276 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1277 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1278 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1279 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1280 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1281 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1282 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1283 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1284 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1285 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1286 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1287 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1288 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1289 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1290 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1291 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1292 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1293 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1294 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1295 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1296 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1297 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1298 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1299 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1300 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1301 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1302 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1303 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1304 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1305 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1306 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1307 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1308 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1309 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1310 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1311 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1312 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1313 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1314 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1315 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1316 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1317 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1318 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1319 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1320 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1321 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1322 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1323 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1324 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1325 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1326 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1327 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1328 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1329 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1330 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1331 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1332 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1333 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1334 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1335 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1336 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1337 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1338 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1339 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1340 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1341 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1342 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1343 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1344 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1345 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1346 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1347 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1348 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1349 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1350 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1351 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1352 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1353 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1354 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1355 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1356 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1357 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1358 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1359 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1360 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1361 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1362 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1363 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1364 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1365 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1366 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1367 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1368 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1369 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1370 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1371 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1372 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1373 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1374 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1375 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1376 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1377 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1378 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1379 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1380 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1381 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1382 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1383 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1384 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1385 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1386 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1387 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1388 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1389 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1390 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1391 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1392 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1393 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1394 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1395 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1396 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1397 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1398 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1399 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1400 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1401 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1402 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1403 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1404 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1405 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1406 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1407 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1408 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1409 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1410 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1411 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1412 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1413 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1414 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1415 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1416 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1417 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1418 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1419 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1420 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1421 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1422 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1423 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1424 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1425 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1426 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1427 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1428 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1429 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1430 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1431 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1432 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1433 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1434 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1435 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1436 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1437 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1438 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1439 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1440 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1441 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1442 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1443 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1444 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1445 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1446 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1447 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1448 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1449 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1450 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1451 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1452 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1453 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1454 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1455 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1456 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1457 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1458 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1459 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1460 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1461 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1462 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1463 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1464 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1465 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1466 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1467 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1468 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1469 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1470 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1471 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1472 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1473 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1474 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1475 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1476 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1477 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1478 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1479 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1480 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1481 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1482 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1483 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1484 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1485 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1486 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1487 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1488 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1489 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1490 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1491 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1492 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1493 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1494 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1495 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1496 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1497 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1498 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1499 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1500 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1501 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1502 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1503 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1504 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1505 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1506 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1507 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1508 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1509 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Region: id = 1510 start_va = 0x2990000 end_va = 0x2e9ffff monitored = 1 entry_point = 0x0 region_type = private name = "private_0x0000000002990000" filename = "" Thread: id = 4 os_tid = 0xee8 [0074.381] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74da0000 [0074.381] GetProcAddress (hModule=0x74da0000, lpProcName="WritePrivateProfileStringA") returned 0x74dd7018 [0074.381] GetProcAddress (hModule=0x74da0000, lpProcName="WriteFile") returned 0x74db1282 [0074.381] GetProcAddress (hModule=0x74da0000, lpProcName="WideCharToMultiByte") returned 0x74db16ed [0074.381] GetProcAddress (hModule=0x74da0000, lpProcName="SetFilePointer") returned 0x74db17b1 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="SetEndOfFile") returned 0x74dcce06 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="ReadFile") returned 0x74db3e83 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="MultiByteToWideChar") returned 0x74db190e [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="MoveFileA") returned 0x74e2dd81 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="LockResource") returned 0x74db5911 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="LoadResource") returned 0x74db5904 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="LoadLibraryA") returned 0x74db498f [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="GetProcAddress") returned 0x74db1222 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="GetPrivateProfileIntA") returned 0x74ddcdc7 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="GetModuleHandleA") returned 0x74db1245 [0074.382] GetProcAddress (hModule=0x74da0000, lpProcName="GetModuleFileNameA") returned 0x74db1491 [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="GetLastError") returned 0x74db11c0 [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="GetFileSize") returned 0x74db194e [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="GetFileAttributesA") returned 0x74db53cc [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="GetCommandLineA") returned 0x74db5159 [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="FreeResource") returned 0x74dcd3ab [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="FreeLibrary") returned 0x74db3478 [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="FormatMessageA") returned 0x74dd5f8d [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="FindResourceA") returned 0x74dce98b [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="FindNextFileA") returned 0x74ddd52e [0074.383] GetProcAddress (hModule=0x74da0000, lpProcName="FindFirstFileA") returned 0x74dbe286 [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="FindClose") returned 0x74db43fa [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="DeleteFileA") returned 0x74db53fc [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="CreateFileA") returned 0x74db537e [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="CloseHandle") returned 0x74db13f0 [0074.384] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74da0000 [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="TlsSetValue") returned 0x74db14db [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="TlsGetValue") returned 0x74db11e0 [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="LocalAlloc") returned 0x74db166c [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="GetModuleHandleA") returned 0x74db1245 [0074.384] GetProcAddress (hModule=0x74da0000, lpProcName="GetModuleFileNameA") returned 0x74db1491 [0074.384] LoadLibraryA (lpLibFileName="KERNEL32.DLL") returned 0x74da0000 [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="GetCurrentThreadId") returned 0x74db1430 [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="DeleteCriticalSection") returned 0x76f745f5 [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="LeaveCriticalSection") returned 0x76f62270 [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="EnterCriticalSection") returned 0x76f622b0 [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="InitializeCriticalSection") returned 0x76f72c42 [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="VirtualFree") returned 0x74db184e [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="VirtualAlloc") returned 0x74db1836 [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="LocalFree") returned 0x74db2cec [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="LocalAlloc") returned 0x74db166c [0074.385] GetProcAddress (hModule=0x74da0000, lpProcName="VirtualQuery") returned 0x74db4412 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="lstrlenA") returned 0x74db5a03 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="lstrcpyA") returned 0x74dd2a6d [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="LoadLibraryExA") returned 0x74db48cb [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="GetThreadLocale") returned 0x74db357f [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="GetStartupInfoA") returned 0x74db0e00 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="GetModuleFileNameA") returned 0x74db1491 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="GetLocaleInfoA") returned 0x74dcd5b5 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="GetLastError") returned 0x74db11c0 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="GetCommandLineA") returned 0x74db5159 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="FreeLibrary") returned 0x74db3478 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="ExitProcess") returned 0x74db79c8 [0074.386] GetProcAddress (hModule=0x74da0000, lpProcName="WriteFile") returned 0x74db1282 [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="SetFilePointer") returned 0x74db17b1 [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="SetEndOfFile") returned 0x74dcce06 [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="RtlUnwind") returned 0x74ddd1b3 [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="ReadFile") returned 0x74db3e83 [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="RaiseException") returned 0x74db585e [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="GetStdHandle") returned 0x74db516b [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="GetFileSize") returned 0x74db194e [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="GetSystemTime") returned 0x74db5a4e [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="GetFileType") returned 0x74db34e1 [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="CreateFileA") returned 0x74db537e [0074.387] GetProcAddress (hModule=0x74da0000, lpProcName="CloseHandle") returned 0x74db13f0 [0074.387] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74fa0000 [0074.388] GetProcAddress (hModule=0x74fa0000, lpProcName="RegSetValueExA") returned 0x74fb14b3 [0074.388] GetProcAddress (hModule=0x74fa0000, lpProcName="RegQueryValueExA") returned 0x74fb48ef [0074.388] GetProcAddress (hModule=0x74fa0000, lpProcName="RegOpenKeyExA") returned 0x74fb4907 [0074.388] GetProcAddress (hModule=0x74fa0000, lpProcName="RegCreateKeyExA") returned 0x74fb1469 [0074.388] GetProcAddress (hModule=0x74fa0000, lpProcName="RegCloseKey") returned 0x74fb469d [0074.388] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74fa0000 [0074.388] GetProcAddress (hModule=0x74fa0000, lpProcName="RegQueryValueExA") returned 0x74fb48ef [0074.388] GetProcAddress (hModule=0x74fa0000, lpProcName="RegOpenKeyExA") returned 0x74fb4907 [0074.388] GetProcAddress (hModule=0x74fa0000, lpProcName="RegCloseKey") returned 0x74fb469d [0074.388] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x72160000 [0074.388] GetProcAddress (hModule=0x72160000, lpProcName="InitCommonControls") returned 0x72161739 [0074.388] LoadLibraryA (lpLibFileName="gdi32.dll") returned 0x75960000 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="StretchDIBits") returned 0x75977435 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SetWindowOrgEx") returned 0x7597af0a [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SetTextColor") returned 0x7597522d [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SetROP2") returned 0x7597bc54 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SetBrushOrgEx") returned 0x75979541 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SetBkMode") returned 0x759751a2 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SetBkColor") returned 0x759752d8 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SelectObject") returned 0x75974f70 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SelectClipRgn") returned 0x75978916 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="SaveDC") returned 0x75976e05 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="RestoreDC") returned 0x75976ead [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="MoveToEx") returned 0x75978ee6 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="IntersectClipRect") returned 0x75977dc4 [0074.389] GetProcAddress (hModule=0x75960000, lpProcName="GetWindowOrgEx") returned 0x7597e310 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="GetStockObject") returned 0x75974eb8 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="GetObjectA") returned 0x759785d4 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="GetDeviceCaps") returned 0x75974de0 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="ExcludeClipRect") returned 0x7597a066 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="DeleteObject") returned 0x75975689 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="DeleteDC") returned 0x759758b3 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="CreateSolidBrush") returned 0x75974f17 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="CreateRectRgnIndirect") returned 0x7597a764 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="CreateRectRgn") returned 0x759777cf [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="CreateFontIndirectA") returned 0x7597cffd [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="CreateDIBSection") returned 0x7597ac46 [0074.390] GetProcAddress (hModule=0x75960000, lpProcName="CreateCompatibleDC") returned 0x759754f4 [0074.391] GetProcAddress (hModule=0x75960000, lpProcName="CreateCompatibleBitmap") returned 0x75975f49 [0074.391] GetProcAddress (hModule=0x75960000, lpProcName="CombineRgn") returned 0x7597a903 [0074.391] GetProcAddress (hModule=0x75960000, lpProcName="BitBlt") returned 0x75975ea6 [0074.391] LoadLibraryA (lpLibFileName="oleaut32.dll") returned 0x75e30000 [0074.391] GetProcAddress (hModule=0x75e30000, lpProcName="VariantCopyInd") returned 0x75e4e86c [0074.391] GetProcAddress (hModule=0x75e30000, lpProcName="VariantClear") returned 0x75e33eae [0074.391] GetProcAddress (hModule=0x75e30000, lpProcName="SysFreeString") returned 0x75e33e59 [0074.391] GetProcAddress (hModule=0x75e30000, lpProcName="SysReAllocStringLen") returned 0x75e37810 [0074.391] GetProcAddress (hModule=0x75e30000, lpProcName="SysAllocStringLen") returned 0x75e345d2 [0074.391] LoadLibraryA (lpLibFileName="shell32.dll") returned 0x75ec0000 [0074.392] GetProcAddress (hModule=0x75ec0000, lpProcName="SHFileOperationA") returned 0x7611addd [0074.392] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74c80000 [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="WaitMessage") returned 0x74cbf5a9 [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="ValidateRect") returned 0x74ca7849 [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="UpdateWindow") returned 0x74ca3559 [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="TranslateMessage") returned 0x74c97809 [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="ShowWindow") returned 0x74ca0dfb [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="SetWindowTextA") returned 0x74ca7aee [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="SetWindowPos") returned 0x74c98e4e [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="SetWindowLongA") returned 0x74ca6110 [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="SetTimer") returned 0x74c979fb [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="SetPropA") returned 0x74ca822c [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="SetFocus") returned 0x74ca2175 [0074.392] GetProcAddress (hModule=0x74c80000, lpProcName="SetCursor") returned 0x74ca41f6 [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="SetCapture") returned 0x74cbed56 [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="SendMessageA") returned 0x74ca612e [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="ScreenToClient") returned 0x74ca227d [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="RemovePropA") returned 0x74ca8284 [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="ReleaseDC") returned 0x74c97446 [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="ReleaseCapture") returned 0x74cbed49 [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="RegisterWindowMessageA") returned 0x74ca0afa [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="RegisterClassA") returned 0x74ca434b [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="PostQuitMessage") returned 0x74c99abb [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="PostMessageA") returned 0x74ca3baa [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="PeekMessageA") returned 0x74ca5f74 [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="OffsetRect") returned 0x74ca0bbd [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="MoveWindow") returned 0x74ca3698 [0074.393] GetProcAddress (hModule=0x74c80000, lpProcName="MessageBoxA") returned 0x74cefd1e [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="LoadIconA") returned 0x74c9dafb [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="LoadCursorA") returned 0x74c9dad5 [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="KillTimer") returned 0x74c979db [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="IsZoomed") returned 0x74ca3332 [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="IsWindowVisible") returned 0x74ca112d [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="IsWindowEnabled") returned 0x74ca2c1b [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="IsWindow") returned 0x74c97136 [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="IsIconic") returned 0x74ca32a9 [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="InvalidateRgn") returned 0x74ca6604 [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="InvalidateRect") returned 0x74ca1381 [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="InflateRect") returned 0x74ca3309 [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="GetWindowRect") returned 0x74c97f34 [0074.394] GetProcAddress (hModule=0x74c80000, lpProcName="GetWindowLongA") returned 0x74c9d156 [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetWindowDC") returned 0x74c98048 [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetUpdateRgn") returned 0x74ca6222 [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetUpdateRect") returned 0x74cbd41f [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetSystemMenu") returned 0x74ca6ea6 [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetSysColor") returned 0x74c96c3c [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetPropA") returned 0x74ca7b5a [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetParent") returned 0x74ca0f68 [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetWindow") returned 0x74c9926e [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetKeyState") returned 0x74ca291f [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetFocus") returned 0x74ca0dee [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetDC") returned 0x74c972c4 [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetCursorPos") returned 0x74ca1218 [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetClientRect") returned 0x74ca0c62 [0074.395] GetProcAddress (hModule=0x74c80000, lpProcName="GetClassLongA") returned 0x74ca86f9 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="GetClassInfoA") returned 0x74ca6ade [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="GetCapture") returned 0x74ca2aac [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="GetAsyncKeyState") returned 0x74cbeb96 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="FillRect") returned 0x74ca0eb6 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="EndPaint") returned 0x74ca1341 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="EnableWindow") returned 0x74ca2da4 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="EnableMenuItem") returned 0x74ca6f50 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="DispatchMessageA") returned 0x74c97bbb [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="DestroyWindow") returned 0x74c99a55 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="DestroyIcon") returned 0x74ca49b2 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="DestroyAcceleratorTable") returned 0x74ca3db6 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="DeleteMenu") returned 0x74ca6d2a [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="DefWindowProcA") returned 0x76f824e0 [0074.396] GetProcAddress (hModule=0x74c80000, lpProcName="CreateWindowExA") returned 0x74c9d22e [0074.397] GetProcAddress (hModule=0x74c80000, lpProcName="CopyImage") returned 0x74ca4a09 [0074.397] GetProcAddress (hModule=0x74c80000, lpProcName="ClientToScreen") returned 0x74ca2606 [0074.397] GetProcAddress (hModule=0x74c80000, lpProcName="CallWindowProcA") returned 0x74ca792f [0074.397] GetProcAddress (hModule=0x74c80000, lpProcName="BeginPaint") returned 0x74ca1361 [0074.397] GetProcAddress (hModule=0x74c80000, lpProcName="CharLowerA") returned 0x74ca3e75 [0074.397] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74c80000 [0074.397] GetProcAddress (hModule=0x74c80000, lpProcName="GetKeyboardType") returned 0x74cd9ac4 [0074.397] GetProcAddress (hModule=0x74c80000, lpProcName="MessageBoxA") returned 0x74cefd1e [0074.400] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0074.400] GetModuleFileNameA (in: hModule=0x400000, lpFilename=0x18fe5c, nSize=0x105 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\cvtres.exe")) returned 0x38 [0074.403] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x18fd37, nSize=0x105 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" (normalized: "c:\\windows\\microsoft.net\\framework\\v2.0.50727\\cvtres.exe")) returned 0x38 [0074.403] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18fe4c | out: phkResult=0x18fe4c*=0x0) returned 0x2 [0074.403] RegOpenKeyExA (in: hKey=0x80000001, lpSubKey="Software\\Borland\\Delphi\\Locales", ulOptions=0x0, samDesired=0xf003f, phkResult=0x18fe4c | out: phkResult=0x18fe4c*=0x0) returned 0x2 [0074.403] lstrcpyA (in: lpString1=0x18fd37, lpString2="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" | out: lpString1="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe") returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" [0074.403] GetThreadLocale () returned 0x409 [0074.403] GetLocaleInfoA (in: Locale=0x409, LCType=0x3, lpLCData=0x18fe47, cchData=5 | out: lpLCData="ENU") returned 4 [0074.415] lstrlenA (lpString="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe") returned 56 [0074.416] lstrcpyA (in: lpString1=0x18fd6c, lpString2="ENU" | out: lpString1="ENU") returned="ENU" [0074.416] LoadLibraryExA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.ENU", hFile=0x0, dwFlags=0x2) returned 0x0 [0074.416] lstrcpyA (in: lpString1=0x18fd6c, lpString2="EN" | out: lpString1="EN") returned="EN" [0074.416] LoadLibraryExA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.EN", hFile=0x0, dwFlags=0x2) returned 0x0 [0074.420] GetKeyboardType (nTypeFlag=0) returned 4 [0074.420] GetCommandLineA () returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" [0074.420] GetStartupInfoA (in: lpStartupInfo=0x18fef0 | out: lpStartupInfo=0x18fef0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xffffffff, hStdOutput=0xffffffff, hStdError=0xffffffff)) [0074.420] GetCurrentThreadId () returned 0xee8 [0074.430] InitCommonControls () [0074.430] LoadLibraryA (lpLibFileName="comctl32.dll") returned 0x72160000 [0074.430] GetProcAddress (hModule=0x72160000, lpProcName="InitCommonControlsEx") returned 0x72166be6 [0074.430] InitCommonControlsEx (picce=0x18ff34) returned 1 [0074.433] LocalAlloc (uFlags=0x0, uBytes=0xff8) returned 0x266c70 [0074.434] VirtualAlloc (lpAddress=0x0, dwSize=0x100000, flAllocationType=0x2000, flProtect=0x1) returned 0x1c40000 [0074.434] LocalAlloc (uFlags=0x0, uBytes=0x644) returned 0x267c70 [0074.434] VirtualAlloc (lpAddress=0x1c40000, dwSize=0x4000, flAllocationType=0x1000, flProtect=0x4) returned 0x1c40000 [0074.440] RegisterClipboardFormatA (lpszFormat="inner message") returned 0xc1be [0074.443] GetSystemTime (in: lpSystemTime=0x18ff2c | out: lpSystemTime=0x18ff2c*(wYear=0x7e6, wMonth=0x4, wDayOfWeek=0x6, wDay=0x17, wHour=0x4, wMinute=0x11, wSecond=0x16, wMilliseconds=0x64)) [0074.446] GetCommandLineA () returned="C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\cvtres.exe" [0074.448] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0074.448] GetClassInfoA (in: hInstance=0x400000, lpClassName="App", lpWndClass=0x18fe9c | out: lpWndClass=0x18fe9c) returned 0 [0074.448] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_App", lpWndClass=0x18fe04 | out: lpWndClass=0x18fe04) returned 0 [0074.449] RegisterClassA (lpWndClass=0x18fe9c) returned 0x1ac19e [0074.449] CreateWindowExA (dwExStyle=0x40000, lpClassName="obj_App", lpWindowName="Form", dwStyle=0x80ca0000, X=-2147483648, Y=-2147483648, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0xc005e [0074.457] SetPropA (hWnd=0xc005e, lpString="SELF_", hData=0x1c4038c) returned 1 [0074.457] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x81, wParam=0x0, lParam=0x18fa4c) returned 0x1 [0074.459] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.459] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x83, wParam=0x0, lParam=0x18fa38) returned 0x0 [0074.645] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.645] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x1, wParam=0x0, lParam=0x18fa4c) returned 0x0 [0074.645] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.645] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0074.645] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.645] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x3, wParam=0x0, lParam=0x190003) returned 0x0 [0074.645] SendMessageA (hWnd=0xc005e, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0074.645] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.645] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0074.645] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.645] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x0 [0074.647] SendMessageA (hWnd=0xc005e, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0074.647] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.647] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0074.670] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.670] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0074.670] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.670] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0074.670] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.670] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0074.674] GetSystemMenu (hWnd=0xc005e, bRevert=0) returned 0x701d9 [0074.692] EnableMenuItem (hMenu=0x701d9, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0074.692] DeleteMenu (hMenu=0x701d9, uPosition=0xf000, uFlags=0x0) returned 1 [0074.692] DeleteMenu (hMenu=0x701d9, uPosition=0xf010, uFlags=0x0) returned 1 [0074.692] DeleteMenu (hMenu=0x701d9, uPosition=0xf030, uFlags=0x0) returned 1 [0074.692] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0074.692] GetClassInfoA (in: hInstance=0x400000, lpClassName="Form", lpWndClass=0x18fe18 | out: lpWndClass=0x18fe18) returned 0 [0074.692] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_Form", lpWndClass=0x18fd80 | out: lpWndClass=0x18fd80) returned 0 [0074.693] RegisterClassA (lpWndClass=0x18fe18) returned 0xc076 [0074.693] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_Form", lpWindowName="Form", dwStyle=0x6cf0000, X=-2147483648, Y=-2147483648, nWidth=64, nHeight=64, hWndParent=0xc005e, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x9003e [0074.693] SetPropA (hWnd=0x9003e, lpString="SELF_", hData=0x1c409c8) returned 1 [0074.693] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x24, wParam=0x0, lParam=0x18f9d4) returned 0x0 [0074.693] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.693] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x81, wParam=0x0, lParam=0x18f9c8) returned 0x1 [0074.693] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.693] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x83, wParam=0x0, lParam=0x18f9b4) returned 0x0 [0074.694] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.694] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x1, wParam=0x0, lParam=0x18f9c8) returned 0x0 [0074.694] SendMessageA (hWnd=0x9003e, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0074.694] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.694] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0074.694] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.695] LoadIconA (hInstance=0x400000, lpIconName="MAINICON") returned 0x0 [0074.695] SendMessageA (hWnd=0x9003e, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0074.695] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.695] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x80, wParam=0x1, lParam=0x0) returned 0x0 [0074.695] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.695] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x0 [0074.695] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.695] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x7f, wParam=0x0, lParam=0x0) returned 0x0 [0074.696] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.696] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x7f, wParam=0x1, lParam=0x0) returned 0x0 [0074.698] LoadIconA (hInstance=0x400000, lpIconName="ICON0") returned 0x1202b1 [0074.699] SendMessageA (hWnd=0xc005e, Msg=0x80, wParam=0x1, lParam=0x1202b1) returned 0x0 [0074.699] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.699] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x80, wParam=0x1, lParam=0x1202b1) returned 0x0 [0074.701] GetPropA (hWnd=0xc005e, lpString="SELF_") returned 0x1c4038c [0074.701] NtdllDefWindowProc_A (hWnd=0xc005e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0xd01e9 [0074.702] SendMessageA (hWnd=0x9003e, Msg=0x80, wParam=0x1, lParam=0x1202b1) returned 0x0 [0074.702] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.702] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x80, wParam=0x1, lParam=0x1202b1) returned 0x0 [0074.703] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.703] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x1e00f3 [0074.704] InvalidateRect (hWnd=0x9003e, lpRect=0x0, bErase=1) returned 1 [0074.704] GetWindowRect (in: hWnd=0x9003e, lpRect=0x18febc | out: lpRect=0x18febc) returned 1 [0074.704] GetWindowRect (in: hWnd=0x9003e, lpRect=0x18fea0 | out: lpRect=0x18fea0) returned 1 [0074.704] SetWindowPos (hWnd=0x9003e, hWndInsertAfter=0x0, X=0, Y=150, cx=132, cy=64, uFlags=0x14) returned 1 [0074.704] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.704] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x46, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0074.704] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.704] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x24, wParam=0x0, lParam=0x18fb74) returned 0x0 [0074.705] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.705] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x47, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0074.705] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.705] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x3, wParam=0x0, lParam=0xb40008) returned 0x0 [0074.706] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.706] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x83, wParam=0x1, lParam=0x18fa30) returned 0x0 [0074.706] GetWindowRect (in: hWnd=0x9003e, lpRect=0x18feb8 | out: lpRect=0x18feb8) returned 1 [0074.706] GetWindowRect (in: hWnd=0x9003e, lpRect=0x18fea0 | out: lpRect=0x18fea0) returned 1 [0074.706] SetWindowPos (hWnd=0x9003e, hWndInsertAfter=0x0, X=0, Y=0, cx=132, cy=64, uFlags=0x14) returned 1 [0074.706] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.706] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x46, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0074.706] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.707] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x24, wParam=0x0, lParam=0x18fb74) returned 0x0 [0074.707] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.707] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x47, wParam=0x0, lParam=0x18fe4c) returned 0x0 [0074.707] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.707] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x3, wParam=0x0, lParam=0x1e0008) returned 0x0 [0074.707] GetWindowRect (in: hWnd=0x9003e, lpRect=0x18fecc | out: lpRect=0x18fecc) returned 1 [0074.707] GetWindowRect (in: hWnd=0x9003e, lpRect=0x18feb0 | out: lpRect=0x18feb0) returned 1 [0074.707] SetWindowPos (hWnd=0x9003e, hWndInsertAfter=0x0, X=0, Y=0, cx=500, cy=242, uFlags=0x14) returned 1 [0074.708] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.708] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x46, wParam=0x0, lParam=0x18fe5c) returned 0x0 [0074.708] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.708] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x24, wParam=0x0, lParam=0x18fb84) returned 0x0 [0074.708] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.708] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x83, wParam=0x1, lParam=0x18fe34) returned 0x0 [0074.708] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.708] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x47, wParam=0x0, lParam=0x18fe5c) returned 0x0 [0074.708] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.708] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x5, wParam=0x0, lParam=0xcc01e4) returned 0x0 [0074.709] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.709] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x83, wParam=0x1, lParam=0x18fa40) returned 0x0 [0074.709] GetWindowLongA (hWnd=0x9003e, nIndex=-16) returned 114229248 [0074.709] GetWindowLongA (hWnd=0x9003e, nIndex=-20) returned 65792 [0074.709] GetClassLongA (hWnd=0x9003e, nIndex=-26) returned 0x8 [0074.709] IsWindowEnabled (hWnd=0x9003e) returned 1 [0074.709] LoadCursorA (hInstance=0x0, lpCursorName=0x0) returned 0x0 [0074.710] CreateFontIndirectA (lplf=0x1c4110d) returned 0x80a0b4a [0074.710] SendMessageA (hWnd=0x9003e, Msg=0x30, wParam=0x80a0b4a, lParam=0xffff) returned 0x0 [0074.710] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.710] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x30, wParam=0x80a0b4a, lParam=0xffff) returned 0x0 [0074.710] InvalidateRect (hWnd=0x9003e, lpRect=0x0, bErase=1) returned 1 [0074.710] GetDC (hWnd=0x0) returned 0x6010b30 [0074.710] GetDeviceCaps (hdc=0x6010b30, index=90) returned 96 [0074.710] ReleaseDC (hWnd=0x0, hDC=0x6010b30) returned 1 [0074.710] CreateFontIndirectA (lplf=0x1c4110d) returned 0x30a0b45 [0074.710] SendMessageA (hWnd=0x9003e, Msg=0x30, wParam=0x30a0b45, lParam=0xffff) returned 0x0 [0074.710] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.710] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x30, wParam=0x30a0b45, lParam=0xffff) returned 0x0 [0074.710] InvalidateRect (hWnd=0x9003e, lpRect=0x0, bErase=1) returned 1 [0074.710] DeleteObject (ho=0x80a0b4a) returned 1 [0074.710] SendMessageA (hWnd=0x9003e, Msg=0x30, wParam=0x30a0b45, lParam=0xffff) returned 0x0 [0074.710] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.710] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x30, wParam=0x30a0b45, lParam=0xffff) returned 0x0 [0074.710] InvalidateRect (hWnd=0x9003e, lpRect=0x0, bErase=1) returned 1 [0074.710] SetWindowPos (hWnd=0x9003e, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x293) returned 1 [0074.710] GetPropA (hWnd=0x9003e, lpString="SELF_") returned 0x1c409c8 [0074.710] NtdllDefWindowProc_A (hWnd=0x9003e, Msg=0x46, wParam=0x0, lParam=0x18fe98) returned 0x0 [0074.710] ShowWindow (hWnd=0x9003e, nCmdShow=0) returned 0 [0074.710] GetClientRect (in: hWnd=0xc005e, lpRect=0x18feb8 | out: lpRect=0x18feb8) returned 1 [0074.710] FindResourceA (hModule=0x400000, lpName="Str1", lpType=0x64) returned 0x421150 [0074.711] LoadResource (hModule=0x400000, hResInfo=0x421150) returned 0x41dccc [0074.711] LockResource (hResData=0x41dccc) returned 0x41dccc [0074.711] FreeResource (hResData=0x41dccc) returned 0 [0074.711] ShowWindow (hWnd=0xc005e, nCmdShow=0) returned 0 [0074.711] GetSystemTime (in: lpSystemTime=0x18fe7c | out: lpSystemTime=0x18fe7c*(wYear=0x7e6, wMonth=0x4, wDayOfWeek=0x6, wDay=0x17, wHour=0x4, wMinute=0x11, wSecond=0x16, wMilliseconds=0xc2)) [0074.711] LoadCursorA (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0074.711] GetClassInfoA (in: hInstance=0x400000, lpClassName="", lpWndClass=0x18fe60 | out: lpWndClass=0x18fe60) returned 0 [0074.711] GetClassInfoA (in: hInstance=0x400000, lpClassName="obj_", lpWndClass=0x18fdc8 | out: lpWndClass=0x18fdc8) returned 0 [0074.711] RegisterClassA (lpWndClass=0x18fe60) returned 0x3bc079 [0074.711] CreateWindowExA (dwExStyle=0x10000, lpClassName="obj_", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=-2147483648, nHeight=-2147483648, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x5005c [0074.711] SetPropA (hWnd=0x5005c, lpString="SELF_", hData=0x1c42a68) returned 1 [0074.711] NtdllDefWindowProc_A (hWnd=0x5005c, Msg=0x24, wParam=0x0, lParam=0x18fa1c) returned 0x0 [0074.711] GetPropA (hWnd=0x5005c, lpString="SELF_") returned 0x1c42a68 [0074.711] NtdllDefWindowProc_A (hWnd=0x5005c, Msg=0x81, wParam=0x0, lParam=0x18fa10) returned 0x1 [0074.711] GetPropA (hWnd=0x5005c, lpString="SELF_") returned 0x1c42a68 [0074.711] NtdllDefWindowProc_A (hWnd=0x5005c, Msg=0x83, wParam=0x0, lParam=0x18f9fc) returned 0x0 [0074.712] GetPropA (hWnd=0x5005c, lpString="SELF_") returned 0x1c42a68 [0074.712] NtdllDefWindowProc_A (hWnd=0x5005c, Msg=0x1, wParam=0x0, lParam=0x18fa10) returned 0x0 [0074.712] SendMessageA (hWnd=0x5005c, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0074.712] GetPropA (hWnd=0x5005c, lpString="SELF_") returned 0x1c42a68 [0074.712] NtdllDefWindowProc_A (hWnd=0x5005c, Msg=0x128, wParam=0x10002, lParam=0x0) returned 0x0 [0074.712] GetPropA (hWnd=0x5005c, lpString="SELF_") returned 0x1c42a68 [0074.712] SetTimer (hWnd=0x5005c, nIDEvent=0x1c41ebc, uElapse=0x1388, lpTimerFunc=0x408f14) returned 0x1c41ebc [0074.712] SetTimer (hWnd=0x5005c, nIDEvent=0x1c41f90, uElapse=0x2328, lpTimerFunc=0x408f14) returned 0x1c41f90 [0074.712] ShowWindow (hWnd=0x9003e, nCmdShow=0) returned 0 [0074.712] GetClientRect (in: hWnd=0xc005e, lpRect=0x18ff24 | out: lpRect=0x18ff24) returned 1 [0074.712] WaitMessage () returned 1 [0079.713] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0079.713] TranslateMessage (lpMsg=0x18ff34) returned 0 [0079.713] DispatchMessageA (lpMsg=0x18ff34) returned 0x0 [0079.714] GetSystemTime (in: lpSystemTime=0x18fd94 | out: lpSystemTime=0x18fd94*(wYear=0x7e6, wMonth=0x4, wDayOfWeek=0x6, wDay=0x17, wHour=0x4, wMinute=0x11, wSecond=0x1b, wMilliseconds=0xc9)) [0079.718] KillTimer (hWnd=0x5005c, uIDEvent=0x1c41ebc) returned 1 [0079.718] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 0 [0079.718] WaitMessage () returned 1 [0083.703] PeekMessageA (in: lpMsg=0x18ff34, hWnd=0x0, wMsgFilterMin=0x0, wMsgFilterMax=0x0, wRemoveMsg=0x1 | out: lpMsg=0x18ff34) returned 1 [0083.703] TranslateMessage (lpMsg=0x18ff34) returned 0 [0083.703] DispatchMessageA (lpMsg=0x18ff34) [0083.704] FindFirstFileA (in: lpFileName="C:\\Users\\*.*", lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74c96ce9, dwReserved1=0x74c96d91, cFileName=".", cAlternateFileName="")) returned 0x269b70 [0083.705] FindNextFileA (in: hFindFile=0x269b70, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x791634f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x791634f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74c96ce9, dwReserved1=0x74c96d91, cFileName="..", cAlternateFileName="")) returned 1 [0083.705] FindNextFileA (in: hFindFile=0x269b70, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x74c96d91, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0083.705] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\*.*", lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f800, dwReserved1=0x25019c, cFileName=".", cAlternateFileName="")) returned 0x26abf0 [0083.705] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f800, dwReserved1=0x25019c, cFileName="..", cAlternateFileName="")) returned 1 [0083.706] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x25019c, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0083.706] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Application Data\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x1a, ftCreationTime.dwLowDateTime=0x85000287, ftCreationTime.dwHighDateTime=0x2500c4, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x2574c0, ftLastWriteTime.dwLowDateTime=0xc0002, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x269bb0, nFileSizeLow=0x269bb0, dwReserved0=0x269bab, dwReserved1=0x0, cFileName="\x80ø\x18", cAlternateFileName="ð«&")) returned 0xffffffff [0083.709] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x25019c, cFileName="Desktop", cAlternateFileName="")) returned 1 [0083.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Desktop\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x1a, ftCreationTime.dwLowDateTime=0x85000287, ftCreationTime.dwHighDateTime=0x2500c4, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x2574c0, ftLastWriteTime.dwLowDateTime=0xc0002, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x269bb0, nFileSizeLow=0x269bb0, dwReserved0=0x269bab, dwReserved1=0x0, cFileName="\x80ø\x18", cAlternateFileName="ð«&")) returned 0xffffffff [0083.709] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x25019c, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0083.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x1a, ftCreationTime.dwLowDateTime=0x85000287, ftCreationTime.dwHighDateTime=0x2500c4, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x2574c0, ftLastWriteTime.dwLowDateTime=0xc0002, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x269bb0, nFileSizeLow=0x269bb0, dwReserved0=0x269bab, dwReserved1=0x0, cFileName="\x80ø\x18", cAlternateFileName="ð«&")) returned 0xffffffff [0083.709] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x25019c, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0083.709] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Favorites\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x1a, ftCreationTime.dwLowDateTime=0x85000287, ftCreationTime.dwHighDateTime=0x2500c4, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x2574c0, ftLastWriteTime.dwLowDateTime=0xc0002, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x269bb0, nFileSizeLow=0x269bb0, dwReserved0=0x269bab, dwReserved1=0x0, cFileName="\x80ø\x18", cAlternateFileName="ð«&")) returned 0xffffffff [0083.710] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9152f250, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x9152f250, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x25019c, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0083.710] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9152f250, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x9152f250, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26afe8, dwReserved1=0x250000, cFileName=".", cAlternateFileName="")) returned 0x26bc88 [0083.710] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9152f250, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x9152f250, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26afe8, dwReserved1=0x250000, cFileName="..", cAlternateFileName="")) returned 1 [0083.710] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26afe8, dwReserved1=0x250000, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0083.710] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0083.710] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0083.710] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName="Client", cAlternateFileName="")) returned 1 [0083.710] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26cfe8, dwReserved1=0x250000, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0083.711] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26cfe8, dwReserved1=0x250000, cFileName="..", cAlternateFileName="")) returned 1 [0083.711] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26cfe8, dwReserved1=0x250000, cFileName="1.0", cAlternateFileName="")) returned 1 [0083.711] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0083.711] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0083.711] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="en-US", cAlternateFileName="")) returned 1 [0083.711] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe20 [0083.713] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0083.713] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 1 [0083.717] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.718] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.720] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f22 [0083.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0083.720] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0083.788] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2f22, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2f22, lpOverlapped=0x0) returned 1 [0083.791] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2f30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2f30, lpOverlapped=0x0) returned 1 [0083.792] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0083.856] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0083.882] CloseHandle (hObject=0xec) returned 1 [0083.882] CloseHandle (hObject=0xf0) returned 1 [0083.884] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d.ozq0")) returned 0 [0083.884] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d.ozq0")) returned 0x2020 [0083.885] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 0x26fd98 [0083.885] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2436abaa, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xabde2c6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa65a8bbf, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x2f22, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_CValidator.H1D", cAlternateFileName="HELP_C~1.H1D")) returned 0 [0083.885] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0083.885] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d")) returned 1 [0083.886] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d")) returned 0xffffffff [0083.886] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 1 [0083.886] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0083.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0083.887] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x365fc [0083.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0083.888] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0083.960] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x365fc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x365fc, lpOverlapped=0x0) returned 1 [0084.057] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x36600, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x36600, lpOverlapped=0x0) returned 1 [0084.062] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.129] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.141] CloseHandle (hObject=0xf0) returned 1 [0084.142] CloseHandle (hObject=0xec) returned 1 [0084.145] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w.ozq0")) returned 0 [0084.145] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w.ozq0")) returned 0x2020 [0084.145] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 0x26fd98 [0084.145] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae2660aa, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae2660aa, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x365fc, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MKWD_AssetId.H1W", cAlternateFileName="HELP_M~1.H1W")) returned 0 [0084.146] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0084.146] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w")) returned 1 [0084.148] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w")) returned 0xffffffff [0084.148] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 1 [0084.148] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.148] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.149] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x325ec [0084.149] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0084.149] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0084.222] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x325ec, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x325ec, lpOverlapped=0x0) returned 1 [0084.230] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x325f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x325f0, lpOverlapped=0x0) returned 1 [0084.233] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.290] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.305] CloseHandle (hObject=0xec) returned 1 [0084.305] CloseHandle (hObject=0xf0) returned 1 [0084.308] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w.ozq0")) returned 0 [0084.309] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w.ozq0")) returned 0x2020 [0084.309] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 0x26fd98 [0084.309] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae409b6f, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae409b6f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x325ec, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MKWD_BestBet.H1W", cAlternateFileName="HELP_M~2.H1W")) returned 0 [0084.309] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0084.309] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w")) returned 1 [0084.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w")) returned 0xffffffff [0084.312] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 1 [0084.312] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.312] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.313] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x79f1a [0084.313] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0084.313] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0084.373] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x79f1a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x79f1a, lpOverlapped=0x0) returned 1 [0084.488] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x79f20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x79f20, lpOverlapped=0x0) returned 1 [0084.499] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.556] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.568] CloseHandle (hObject=0xf0) returned 1 [0084.568] CloseHandle (hObject=0xec) returned 1 [0084.574] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h.ozq0")) returned 0 [0084.574] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h.ozq0")) returned 0x2020 [0084.575] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 0x26fd98 [0084.575] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x79f1a, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MTOC_help.H1H", cAlternateFileName="HELP_M~1.H1H")) returned 0 [0084.575] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0084.575] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h")) returned 1 [0084.586] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h")) returned 0xffffffff [0084.586] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 1 [0084.586] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.586] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.587] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3944 [0084.587] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0084.587] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0084.655] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3944, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3944, lpOverlapped=0x0) returned 1 [0084.657] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3950, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3950, lpOverlapped=0x0) returned 1 [0084.658] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.714] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.726] CloseHandle (hObject=0xec) returned 1 [0084.726] CloseHandle (hObject=0xf0) returned 1 [0084.727] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d.ozq0")) returned 0 [0084.728] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d.ozq0")) returned 0x2020 [0084.728] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 0x26fd98 [0084.728] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x26353250, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x3944, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MValidator.H1D", cAlternateFileName="HELP_M~1.H1D")) returned 0 [0084.728] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0084.728] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d")) returned 1 [0084.729] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d")) returned 0xffffffff [0084.729] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 1 [0084.729] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.730] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.730] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4 [0084.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0084.730] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0084.796] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4, lpOverlapped=0x0) returned 1 [0084.798] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x10, lpOverlapped=0x0) returned 1 [0084.800] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0084.862] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0084.877] CloseHandle (hObject=0xf0) returned 1 [0084.878] CloseHandle (hObject=0xec) returned 1 [0084.882] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck.ozq0")) returned 0 [0084.882] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck.ozq0")) returned 0x2020 [0084.882] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 0x26fd98 [0084.883] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x24534c56, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae45604d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae45604d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="Help_MValidator.Lck", cAlternateFileName="HELP_M~1.LCK")) returned 0 [0084.883] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0084.883] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck")) returned 1 [0084.884] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck")) returned 0xffffffff [0084.884] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 1 [0084.884] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0084.885] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0084.885] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5310 [0084.885] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0084.885] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0084.963] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd5310, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd5310, lpOverlapped=0x0) returned 1 [0085.051] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd5320, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd5320, lpOverlapped=0x0) returned 1 [0085.078] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.137] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.150] CloseHandle (hObject=0xec) returned 1 [0085.150] CloseHandle (hObject=0xf0) returned 1 [0085.163] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.ozq0")) returned 0 [0085.164] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.ozq0" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.ozq0")) returned 0x2020 [0085.164] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x270f50, dwReserved1=0x18ebdc, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0x26fd98 [0085.164] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x270f50, dwReserved1=0x18ebdc, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0 [0085.164] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0085.164] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q")) returned 1 [0085.175] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q")) returned 0xffffffff [0085.175] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x249fa376, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xd5310, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", cAlternateFileName="HELP{9~1.H1Q")) returned 0 [0085.175] FindClose (in: hFindFile=0x26fe20 | out: hFindFile=0x26fe20) returned 1 [0085.175] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="en-US", cAlternateFileName="")) returned 0 [0085.175] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0085.175] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26cfe8, dwReserved1=0x250000, cFileName="1.0", cAlternateFileName="")) returned 0 [0085.175] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0085.175] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName="Client", cAlternateFileName="")) returned 0 [0085.176] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0085.176] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7d11070, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d11070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26afe8, dwReserved1=0x250000, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0085.176] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7d11070, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d11070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0085.176] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7d11070, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d11070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0085.176] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2f9e01d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f9e01d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f9e01d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0085.176] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0085.177] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.178] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7b6 [0085.178] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0085.178] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0085.253] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7b6, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x7b6, lpOverlapped=0x0) returned 1 [0085.256] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x7c0, lpOverlapped=0x0) returned 1 [0085.257] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.320] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.337] CloseHandle (hObject=0xe0) returned 1 [0085.337] CloseHandle (hObject=0xe4) returned 1 [0085.338] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.ozq0")) returned 0 [0085.339] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml.ozq0")) returned 0x2020 [0085.339] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2f9e01d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f9e01d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f9e01d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x26dd68, dwReserved1=0x18f314, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 0x26dd60 [0085.339] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2f9e01d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f9e01d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f9e01d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x26dd68, dwReserved1=0x18f314, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 0 [0085.339] FindClose (in: hFindFile=0x26dd60 | out: hFindFile=0x26dd60) returned 1 [0085.340] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 1 [0085.341] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.0.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.0.xml")) returned 0xffffffff [0085.341] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d11070, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7d11070, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d11070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 1 [0085.341] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0085.342] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0085.342] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x566 [0085.342] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0085.343] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0085.428] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x566, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x566, lpOverlapped=0x0) returned 1 [0085.430] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x570, lpOverlapped=0x0) returned 1 [0085.431] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.487] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.499] CloseHandle (hObject=0xe4) returned 1 [0085.499] CloseHandle (hObject=0xe0) returned 1 [0085.501] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.ozq0")) returned 0 [0085.502] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml.ozq0")) returned 0x2020 [0085.502] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d11070, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7d11070, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d11070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x26dd68, dwReserved1=0x18f314, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 0x26dd60 [0085.502] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7d11070, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7d11070, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d11070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x26dd68, dwReserved1=0x18f314, cFileName="DeploymentConfig.2.xml", cAlternateFileName="DEPLOY~2.XML")) returned 0 [0085.502] FindClose (in: hFindFile=0x26dd60 | out: hFindFile=0x26dd60) returned 1 [0085.502] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 1 [0085.503] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\DeploymentConfig.2.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\deploymentconfig.2.xml")) returned 0xffffffff [0085.504] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d7ce6f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d7ce6f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="E728F99D-05D1-4020-9ECE-6DE2EC414166", cAlternateFileName="E728F9~1")) returned 1 [0085.504] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d7ce6f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d7ce6f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26dcd8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0085.504] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d7ce6f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d7ce6f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26dcd8, cFileName="..", cAlternateFileName="")) returned 1 [0085.504] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d736170, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26dcd8, cFileName="en-us.16", cAlternateFileName="")) returned 1 [0085.504] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d736170, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25006c, dwReserved1=0x271fe0, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0085.504] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab6eed0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d736170, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25006c, dwReserved1=0x271fe0, cFileName="..", cAlternateFileName="")) returned 1 [0085.504] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x22d02900, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5765, dwReserved0=0x25006c, dwReserved1=0x271fe0, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0085.504] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\masterdescriptor.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0085.504] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\MasterDescriptor.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\masterdescriptor.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.505] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5765 [0085.505] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0085.506] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0085.569] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5765, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x5765, lpOverlapped=0x0) returned 1 [0085.571] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5770, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x5770, lpOverlapped=0x0) returned 1 [0085.572] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.633] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.646] CloseHandle (hObject=0xe8) returned 1 [0085.646] CloseHandle (hObject=0xf0) returned 1 [0085.651] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\masterdescriptor.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\MasterDescriptor.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\masterdescriptor.en-us.xml.ozq0")) returned 0 [0085.651] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\MasterDescriptor.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\masterdescriptor.en-us.xml.ozq0")) returned 0x2020 [0085.651] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\MasterDescriptor.en-us.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x22d02900, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5765, dwReserved0=0x26fed0, dwReserved1=0x18ee44, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0x26dd18 [0085.652] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x22d02900, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5765, dwReserved0=0x26fed0, dwReserved1=0x18ee44, cFileName="MasterDescriptor.en-us.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0085.652] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0085.652] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\masterdescriptor.en-us.xml")) returned 1 [0085.659] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\MasterDescriptor.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\masterdescriptor.en-us.xml")) returned 0xffffffff [0085.659] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 1 [0085.659] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\s321033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\s321033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.659] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\s321033.hash.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\s321033.hash.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0085.660] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0085.660] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0085.660] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0085.741] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x66, lpOverlapped=0x0) returned 1 [0085.742] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x70, lpOverlapped=0x0) returned 1 [0085.744] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0085.825] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0085.838] CloseHandle (hObject=0xf0) returned 1 [0085.838] CloseHandle (hObject=0xe8) returned 1 [0085.847] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\s321033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\s321033.hash"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\s321033.hash.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\s321033.hash.ozq0")) returned 0 [0085.848] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\s321033.hash.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\s321033.hash.ozq0")) returned 0x2020 [0085.848] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\s321033.hash", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x26feb0, dwReserved1=0x18ee44, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 0x26dd18 [0085.848] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x26feb0, dwReserved1=0x18ee44, cFileName="s321033.hash", cAlternateFileName="S32103~1.HAS")) returned 0 [0085.848] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0085.848] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\s321033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\s321033.hash")) returned 1 [0085.849] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\s321033.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\s321033.hash")) returned 0xffffffff [0085.849] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0085.849] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\stream.x86.en-us.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0085.850] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\stream.x86.en-us.man.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\stream.x86.en-us.man.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0085.850] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd81d4 [0085.850] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0085.851] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0086.020] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd81d4, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xd81d4, lpOverlapped=0x0) returned 1 [0086.096] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd81e0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xd81e0, lpOverlapped=0x0) returned 1 [0086.125] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.192] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.208] CloseHandle (hObject=0xe8) returned 1 [0086.208] CloseHandle (hObject=0xf0) returned 1 [0086.240] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\stream.x86.en-us.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\stream.x86.en-us.man.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\stream.x86.en-us.man.dat.ozq0")) returned 0 [0086.243] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\stream.x86.en-us.man.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\stream.x86.en-us.man.dat.ozq0")) returned 0x2020 [0086.243] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\stream.x86.en-us.man.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x26fec8, dwReserved1=0x18ee44, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x26dd18 [0086.243] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x26fec8, dwReserved1=0x18ee44, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0086.243] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0086.243] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\stream.x86.en-us.man.dat")) returned 1 [0086.252] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\en-us.16\\stream.x86.en-us.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\en-us.16\\stream.x86.en-us.man.dat")) returned 0xffffffff [0086.252] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d736170, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x21ebc700, ftLastWriteTime.dwHighDateTime=0x1d0d7ef, nFileSizeHigh=0x0, nFileSizeLow=0xd81d4, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="stream.x86.en-us.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0086.252] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0086.252] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d7ce6f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d7ce6f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x752d6e65, dwReserved1=0x616d2e73, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0086.252] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d7ce6f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d7ce6f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0086.252] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d7ce6f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d7ce6f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0086.252] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x206dcf00, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 1 [0086.252] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\masterdescriptor.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.252] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\MasterDescriptor.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\masterdescriptor.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.253] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5220 [0086.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0086.254] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0086.313] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5220, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x5220, lpOverlapped=0x0) returned 1 [0086.314] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5230, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x5230, lpOverlapped=0x0) returned 1 [0086.315] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.381] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.396] CloseHandle (hObject=0xf0) returned 1 [0086.396] CloseHandle (hObject=0xe8) returned 1 [0086.397] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\masterdescriptor.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\MasterDescriptor.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\masterdescriptor.x-none.xml.ozq0")) returned 0 [0086.398] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\MasterDescriptor.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\masterdescriptor.x-none.xml.ozq0")) returned 0x2020 [0086.398] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\MasterDescriptor.x-none.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x206dcf00, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x26fed0, dwReserved1=0x18ee44, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0x26dd18 [0086.398] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x206dcf00, ftLastWriteTime.dwHighDateTime=0x1d0d7ee, nFileSizeHigh=0x0, nFileSizeLow=0x5220, dwReserved0=0x26fed0, dwReserved1=0x18ee44, cFileName="MasterDescriptor.x-none.xml", cAlternateFileName="MASTER~1.XML")) returned 0 [0086.398] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0086.398] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\masterdescriptor.x-none.xml")) returned 1 [0086.399] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\MasterDescriptor.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\masterdescriptor.x-none.xml")) returned 0xffffffff [0086.399] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 1 [0086.400] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\s320.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\s320.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.400] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\s320.hash.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\s320.hash.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.400] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x66 [0086.400] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0086.401] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0086.459] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x66, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x66, lpOverlapped=0x0) returned 1 [0086.460] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x70, lpOverlapped=0x0) returned 1 [0086.461] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0086.518] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0086.535] CloseHandle (hObject=0xe8) returned 1 [0086.535] CloseHandle (hObject=0xf0) returned 1 [0086.559] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\s320.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\s320.hash"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\s320.hash.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\s320.hash.ozq0")) returned 0 [0086.559] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\s320.hash.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\s320.hash.ozq0")) returned 0x2020 [0086.560] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\s320.hash", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x26feb0, dwReserved1=0x18ee44, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 0x26dd18 [0086.560] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x341a3500, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x26feb0, dwReserved1=0x18ee44, cFileName="s320.hash", cAlternateFileName="S320~1.HAS")) returned 0 [0086.560] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0086.560] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\s320.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\s320.hash")) returned 1 [0086.562] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\s320.hash" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\s320.hash")) returned 0xffffffff [0086.562] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0086.563] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\stream.x86.x-none.man.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0086.563] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\stream.x86.x-none.man.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\stream.x86.x-none.man.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0086.564] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x38b5ce [0086.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0086.565] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0086.642] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x38b5ce, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x38b5ce, lpOverlapped=0x0) returned 1 [0086.939] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x38b5d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x38b5d0, lpOverlapped=0x0) returned 1 [0087.024] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.105] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.117] CloseHandle (hObject=0xf0) returned 1 [0087.117] CloseHandle (hObject=0xe8) returned 1 [0087.224] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\stream.x86.x-none.man.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\stream.x86.x-none.man.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\stream.x86.x-none.man.dat.ozq0")) returned 0 [0087.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\stream.x86.x-none.man.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\stream.x86.x-none.man.dat.ozq0")) returned 0x2020 [0087.225] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\stream.x86.x-none.man.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x26fed0, dwReserved1=0x18ee44, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x26dd18 [0087.225] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x26fed0, dwReserved1=0x18ee44, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0087.225] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0087.225] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\stream.x86.x-none.man.dat")) returned 1 [0087.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\E728F99D-05D1-4020-9ECE-6DE2EC414166\\x-none.16\\stream.x86.x-none.man.dat" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\e728f99d-05d1-4020-9ece-6de2ec414166\\x-none.16\\stream.x86.x-none.man.dat")) returned 0xffffffff [0087.231] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d782430, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d782430, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x32e90800, ftLastWriteTime.dwHighDateTime=0x1d0d7f0, nFileSizeHigh=0x0, nFileSizeLow=0x38b5ce, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="stream.x86.x-none.man.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0087.231] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0087.231] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2d736170, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2d7ce6f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2d7ce6f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x752d6e65, dwReserved1=0x616d2e73, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0087.231] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0087.231] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f05a9d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="MachineData", cAlternateFileName="MACHIN~1")) returned 1 [0087.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f05a9d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f6e2d78, dwReserved1=0x6d2e656e, cFileName=".", cAlternateFileName="")) returned 0x26dd50 [0087.231] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f05a9d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f6e2d78, dwReserved1=0x6d2e656e, cFileName="..", cAlternateFileName="")) returned 1 [0087.232] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f6e2d78, dwReserved1=0x6d2e656e, cFileName="Catalog", cAlternateFileName="")) returned 1 [0087.232] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0087.232] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0087.232] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Packages", cAlternateFileName="")) returned 1 [0087.232] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe40 [0087.232] FindNextFileA (in: hFindFile=0x26fe40, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0087.232] FindNextFileA (in: hFindFile=0x26fe40, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0087.232] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fda0 [0087.233] FindNextFileA (in: hFindFile=0x26fda0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0087.233] FindNextFileA (in: hFindFile=0x26fda0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa82de610, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa82de610, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 1 [0087.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa82de610, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa82de610, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fde0 [0087.234] FindNextFileA (in: hFindFile=0x26fde0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa82de610, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa82de610, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0087.234] FindNextFileA (in: hFindFile=0x26fde0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x300de270, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300de270, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d35290, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0087.234] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0087.235] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0087.235] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266 [0087.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0087.236] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0087.306] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x266, lpOverlapped=0x0) returned 1 [0087.351] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x270, lpOverlapped=0x0) returned 1 [0087.353] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.414] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.426] CloseHandle (hObject=0xf4) returned 1 [0087.427] CloseHandle (hObject=0xf8) returned 1 [0087.428] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.ozq0")) returned 0 [0087.428] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml.ozq0")) returned 0x2020 [0087.429] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x300de270, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300de270, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d35290, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x273008, dwReserved1=0x18e70c, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 0x273000 [0087.429] FindNextFileA (in: hFindFile=0x273000, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x300de270, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300de270, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d35290, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x273008, dwReserved1=0x18e70c, cFileName="DeploymentConfiguration.xml", cAlternateFileName="DEPLOY~1.XML")) returned 0 [0087.429] FindClose (in: hFindFile=0x273000 | out: hFindFile=0x273000) returned 1 [0087.429] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 1 [0087.430] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\DeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\deploymentconfiguration.xml")) returned 0xffffffff [0087.430] FindNextFileA (in: hFindFile=0x26fde0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f64e0d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f64e0d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f6e6650, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4b480e, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Manifest.xml", cAlternateFileName="")) returned 1 [0087.431] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0087.431] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0087.432] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b480e [0087.432] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0087.432] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0087.492] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4b480e, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4b480e, lpOverlapped=0x0) returned 1 [0087.621] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4b4810, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x4b4810, lpOverlapped=0x0) returned 1 [0087.729] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0087.788] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0087.800] CloseHandle (hObject=0xf8) returned 1 [0087.800] CloseHandle (hObject=0xf4) returned 1 [0088.161] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.ozq0")) returned 0 [0088.162] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml.ozq0")) returned 0x2020 [0088.162] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f64e0d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f64e0d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f6e6650, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4b480e, dwReserved0=0x272ff0, dwReserved1=0x18e70c, cFileName="Manifest.xml", cAlternateFileName="")) returned 0x272fe0 [0088.163] FindNextFileA (in: hFindFile=0x272fe0, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f64e0d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f64e0d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f6e6650, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4b480e, dwReserved0=0x272ff0, dwReserved1=0x18e70c, cFileName="Manifest.xml", cAlternateFileName="")) returned 0 [0088.163] FindClose (in: hFindFile=0x272fe0 | out: hFindFile=0x272fe0) returned 1 [0088.163] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 1 [0088.163] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\Manifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\manifest.xml")) returned 0xffffffff [0088.163] FindNextFileA (in: hFindFile=0x26fde0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x319dc970, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x319dc970, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d35290, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 1 [0088.163] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0088.182] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0088.182] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x266 [0088.182] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0088.183] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0088.273] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x266, lpOverlapped=0x0) returned 1 [0088.278] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x270, lpOverlapped=0x0) returned 1 [0088.279] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.340] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.353] CloseHandle (hObject=0xf4) returned 1 [0088.353] CloseHandle (hObject=0xf8) returned 1 [0088.355] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.ozq0")) returned 0 [0088.355] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml.ozq0")) returned 0x2020 [0088.355] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x319dc970, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x319dc970, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d35290, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x273010, dwReserved1=0x18e70c, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 0x273008 [0088.356] FindNextFileA (in: hFindFile=0x273008, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x319dc970, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x319dc970, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7d35290, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x273010, dwReserved1=0x18e70c, cFileName="UserDeploymentConfiguration.xml", cAlternateFileName="USERDE~1.XML")) returned 0 [0088.356] FindClose (in: hFindFile=0x273008 | out: hFindFile=0x273008) returned 1 [0088.356] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 1 [0088.357] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserDeploymentConfiguration.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\userdeploymentconfiguration.xml")) returned 0xffffffff [0088.357] FindNextFileA (in: hFindFile=0x26fde0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x316bcc90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x316bcc90, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xb252e230, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2f4107, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 1 [0088.357] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0088.357] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0088.358] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f4107 [0088.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0088.358] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0088.420] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2f4107, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x2f4107, lpOverlapped=0x0) returned 1 [0088.491] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2f4110, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x2f4110, lpOverlapped=0x0) returned 1 [0088.553] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0088.604] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0088.616] CloseHandle (hObject=0xf8) returned 1 [0088.617] CloseHandle (hObject=0xf4) returned 1 [0088.802] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.ozq0")) returned 0 [0088.803] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml.ozq0")) returned 0x2020 [0088.804] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x316bcc90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x316bcc90, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xb252e230, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2f4107, dwReserved0=0x272ff8, dwReserved1=0x18e70c, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0x272fe8 [0088.804] FindNextFileA (in: hFindFile=0x272fe8, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x316bcc90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x316bcc90, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xb252e230, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2f4107, dwReserved0=0x272ff8, dwReserved1=0x18e70c, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0 [0088.804] FindClose (in: hFindFile=0x272fe8 | out: hFindFile=0x272fe8) returned 1 [0088.804] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml")) returned 1 [0088.813] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Catalog\\Packages\\{9AC08E99-230B-47E8-9721-4577B7F124EA}\\{1A8308C7-90D1-4200-B16E-646F163A08E8}\\UserManifest.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\machinedata\\catalog\\packages\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\{1a8308c7-90d1-4200-b16e-646f163a08e8}\\usermanifest.xml")) returned 0xffffffff [0088.813] FindNextFileA (in: hFindFile=0x26fde0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x316bcc90, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x316bcc90, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xb252e230, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2f4107, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="UserManifest.xml", cAlternateFileName="USERMA~1.XML")) returned 0 [0088.813] FindClose (in: hFindFile=0x26fde0 | out: hFindFile=0x26fde0) returned 1 [0088.814] FindNextFileA (in: hFindFile=0x26fda0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa82de610, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa82de610, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0088.814] FindClose (in: hFindFile=0x26fda0 | out: hFindFile=0x26fda0) returned 1 [0088.814] FindNextFileA (in: hFindFile=0x26fe40, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0088.814] FindClose (in: hFindFile=0x26fe40 | out: hFindFile=0x26fe40) returned 1 [0088.814] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x300b8110, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x300b8110, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x300b8110, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Packages", cAlternateFileName="")) returned 0 [0088.814] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0088.814] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f6e2d78, dwReserved1=0x6d2e656e, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0088.814] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38453734, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0088.815] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38453734, cFileName="..", cAlternateFileName="")) returned 1 [0088.816] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38453734, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 1 [0088.816] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\MachineData\\Integration\\ShortcutBackups\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d314430, dwReserved1=0x30303234, cFileName=".", cAlternateFileName="")) returned 0x26fe50 [0088.816] FindNextFileA (in: hFindFile=0x26fe50, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d314430, dwReserved1=0x30303234, cFileName="..", cAlternateFileName="")) returned 1 [0088.816] FindNextFileA (in: hFindFile=0x26fe50, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d314430, dwReserved1=0x30303234, cFileName="..", cAlternateFileName="")) returned 0 [0088.816] FindClose (in: hFindFile=0x26fe50 | out: hFindFile=0x26fe50) returned 1 [0088.816] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38453734, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0088.816] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0088.816] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31696b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x31696b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x31696b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f6e2d78, dwReserved1=0x6d2e656e, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0088.817] FindClose (in: hFindFile=0x26dd50 | out: hFindFile=0x26dd50) returned 1 [0088.817] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f05a9d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f05a9d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f05a9d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="UserData", cAlternateFileName="")) returned 1 [0088.817] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\UserData\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f05a9d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f05a9d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f05a9d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7370756b, dwReserved1=0x6d2e656e, cFileName=".", cAlternateFileName="")) returned 0x26dd50 [0088.817] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f05a9d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f05a9d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f05a9d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7370756b, dwReserved1=0x6d2e656e, cFileName="..", cAlternateFileName="")) returned 1 [0088.817] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f05a9d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2f05a9d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x2f05a9d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7370756b, dwReserved1=0x6d2e656e, cFileName="..", cAlternateFileName="")) returned 0 [0088.817] FindClose (in: hFindFile=0x26dd50 | out: hFindFile=0x26dd50) returned 1 [0088.817] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80e27350, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xd7956850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd7956850, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0088.817] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80e27350, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xd7956850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd7956850, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7370756b, dwReserved1=0x6d2e656e, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0088.818] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80e27350, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xd7956850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd7956850, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7370756b, dwReserved1=0x6d2e656e, cFileName="..", cAlternateFileName="")) returned 1 [0088.818] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7956850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd7956850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xcaf6ddf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x7370756b, dwReserved1=0x6d2e656e, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 1 [0088.827] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0088.827] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0088.828] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44e23 [0088.828] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0088.828] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0088.891] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x44e23, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x44e23, lpOverlapped=0x0) returned 1 [0088.954] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x44e30, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x44e30, lpOverlapped=0x0) returned 1 [0088.961] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.016] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.031] CloseHandle (hObject=0xe4) returned 1 [0089.031] CloseHandle (hObject=0xe8) returned 1 [0089.035] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.ozq0")) returned 0 [0089.036] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man.ozq0")) returned 0x2020 [0089.036] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7956850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd7956850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xcaf6ddf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x26eea8, dwReserved1=0x18f0ac, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 0x26dcd8 [0089.036] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7956850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd7956850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xcaf6ddf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x44e23, dwReserved0=0x26eea8, dwReserved1=0x18f0ac, cFileName="AirSpace.Etw.man", cAlternateFileName="AIRSPA~1.MAN")) returned 0 [0089.036] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0089.036] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man")) returned 1 [0089.047] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\AirSpace.Etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\airspace.etw.man")) returned 0xffffffff [0089.047] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813ce790, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813ce790, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d956b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9786, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 1 [0089.047] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.048] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.048] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9786 [0089.048] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0089.048] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0089.107] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9786, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x9786, lpOverlapped=0x0) returned 1 [0089.147] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9790, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x9790, lpOverlapped=0x0) returned 1 [0089.156] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.216] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.229] CloseHandle (hObject=0xe8) returned 1 [0089.229] CloseHandle (hObject=0xe4) returned 1 [0089.231] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0089.231] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0089.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813ce790, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813ce790, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d956b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9786, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 0x26dcd8 [0089.231] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813ce790, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813ce790, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d956b30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9786, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Access.Access.x-none.msi.16.x-none.xml", cAlternateFileName="C25A45~1.XML")) returned 0 [0089.231] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0089.231] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 1 [0089.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Access.Access.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.access.access.x-none.msi.16.x-none.xml")) returned 0xffffffff [0089.233] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813a8630, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813a8630, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e72cb10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xe048, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 1 [0089.233] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.233] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.233] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe048 [0089.233] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0089.234] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0089.310] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe048, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xe048, lpOverlapped=0x0) returned 1 [0089.324] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xe050, lpOverlapped=0x0) returned 1 [0089.325] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.384] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.397] CloseHandle (hObject=0xe4) returned 1 [0089.397] CloseHandle (hObject=0xe8) returned 1 [0089.399] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.ozq0")) returned 0 [0089.399] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0089.399] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813a8630, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813a8630, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e72cb10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xe048, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 0x26dcd8 [0089.399] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813a8630, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813a8630, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e72cb10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xe048, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.accessmui.msi.16.en-us.xml", cAlternateFileName="C222C2~1.XML")) returned 0 [0089.400] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0089.400] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 1 [0089.401] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmui.msi.16.en-us.xml")) returned 0xffffffff [0089.401] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813a8630, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813a8630, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e883770, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 1 [0089.401] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.402] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.402] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fa [0089.402] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0089.403] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0089.456] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x7fa, lpOverlapped=0x0) returned 1 [0089.527] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x800, lpOverlapped=0x0) returned 1 [0089.531] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.595] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.607] CloseHandle (hObject=0xe8) returned 1 [0089.607] CloseHandle (hObject=0xe4) returned 1 [0089.609] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.ozq0")) returned 0 [0089.610] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml.ozq0")) returned 0x2020 [0089.610] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813a8630, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813a8630, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e883770, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 0x26dcd8 [0089.610] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813a8630, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813a8630, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e883770, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.accessmuiset.msi.16.en-us.xml", cAlternateFileName="C2FB2E~1.XML")) returned 0 [0089.610] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0089.610] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 1 [0089.612] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.accessmuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.accessmuiset.msi.16.en-us.xml")) returned 0xffffffff [0089.612] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d90a870, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x410e, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 1 [0089.613] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.613] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.614] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x410e [0089.614] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0089.614] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0089.671] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x410e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x410e, lpOverlapped=0x0) returned 1 [0089.855] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4110, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x4110, lpOverlapped=0x0) returned 1 [0089.859] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0089.919] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0089.977] CloseHandle (hObject=0xe4) returned 1 [0089.977] CloseHandle (hObject=0xe8) returned 1 [0089.978] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0089.979] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0089.979] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d90a870, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x410e, dwReserved0=0x26eee0, dwReserved1=0x18f0ac, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 0x26dcd8 [0089.979] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d90a870, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x410e, dwReserved0=0x26eee0, dwReserved1=0x18f0ac, cFileName="C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml", cAlternateFileName="C210C4~1.XML")) returned 0 [0089.979] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0089.979] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 1 [0089.981] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.DCF.DCF.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcf.dcf.x-none.msi.16.x-none.xml")) returned 0xffffffff [0089.981] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e8f5b90, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2656, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 1 [0089.981] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0089.981] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0089.982] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2656 [0089.982] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0089.982] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0090.042] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2656, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x2656, lpOverlapped=0x0) returned 1 [0090.087] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x2660, lpOverlapped=0x0) returned 1 [0090.089] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.156] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.188] CloseHandle (hObject=0xe8) returned 1 [0090.188] CloseHandle (hObject=0xe4) returned 1 [0090.189] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.ozq0")) returned 0 [0090.190] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0090.190] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e8f5b90, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2656, dwReserved0=0x26eec8, dwReserved1=0x18f0ac, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 0x26dcd8 [0090.190] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e8f5b90, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2656, dwReserved0=0x26eec8, dwReserved1=0x18f0ac, cFileName="C2RManifest.dcfmui.msi.16.en-us.xml", cAlternateFileName="C206B0~1.XML")) returned 0 [0090.190] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0090.190] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 1 [0090.191] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.dcfmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.dcfmui.msi.16.en-us.xml")) returned 0xffffffff [0090.191] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fed45b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3a132, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 1 [0090.191] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.192] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.192] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a132 [0090.192] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0090.193] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0090.251] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3a132, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x3a132, lpOverlapped=0x0) returned 1 [0090.401] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3a140, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x3a140, lpOverlapped=0x0) returned 1 [0090.406] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.468] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.481] CloseHandle (hObject=0xe4) returned 1 [0090.481] CloseHandle (hObject=0xe8) returned 1 [0090.485] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0090.485] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0090.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fed45b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3a132, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 0x26dcd8 [0090.485] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813824d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813824d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fed45b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3a132, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml", cAlternateFileName="C21578~1.XML")) returned 0 [0090.486] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0090.486] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 1 [0090.489] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excel.excel.x-none.msi.16.x-none.xml")) returned 0xffffffff [0090.489] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8135c370, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8135c370, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ea72950, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x88d0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 1 [0090.489] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.490] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.490] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x88d0 [0090.490] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0090.490] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0090.548] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x88d0, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x88d0, lpOverlapped=0x0) returned 1 [0090.657] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x88e0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x88e0, lpOverlapped=0x0) returned 1 [0090.659] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.722] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.735] CloseHandle (hObject=0xe8) returned 1 [0090.735] CloseHandle (hObject=0xe4) returned 1 [0090.737] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.ozq0")) returned 0 [0090.737] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0090.737] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8135c370, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8135c370, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ea72950, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x88d0, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 0x26dcd8 [0090.737] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8135c370, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8135c370, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ea72950, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x88d0, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.excelmui.msi.16.en-us.xml", cAlternateFileName="C2D2CD~1.XML")) returned 0 [0090.737] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0090.737] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 1 [0090.749] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.excelmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.excelmui.msi.16.en-us.xml")) returned 0xffffffff [0090.749] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81336210, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81336210, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7faa9f30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x8f06, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 1 [0090.749] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.750] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.750] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8f06 [0090.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0090.751] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0090.808] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8f06, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x8f06, lpOverlapped=0x0) returned 1 [0090.825] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x8f10, lpOverlapped=0x0) returned 1 [0090.826] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0090.890] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0090.907] CloseHandle (hObject=0xe4) returned 1 [0090.907] CloseHandle (hObject=0xe8) returned 1 [0090.909] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0090.910] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0090.910] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81336210, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81336210, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7faa9f30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x8f06, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 0x26dcd8 [0090.910] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81336210, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81336210, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7faa9f30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x8f06, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml", cAlternateFileName="C233DB~1.XML")) returned 0 [0090.910] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0090.910] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 1 [0090.912] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Groove.Groove.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groove.groove.x-none.msi.16.x-none.xml")) returned 0xffffffff [0090.912] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813100b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813100b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eabec10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x17f6, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 1 [0090.912] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0090.913] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0090.913] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17f6 [0090.913] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0090.914] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0090.987] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x17f6, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x17f6, lpOverlapped=0x0) returned 1 [0091.027] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1800, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1800, lpOverlapped=0x0) returned 1 [0091.028] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.093] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.105] CloseHandle (hObject=0xe8) returned 1 [0091.106] CloseHandle (hObject=0xe4) returned 1 [0091.107] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.ozq0")) returned 0 [0091.107] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0091.107] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813100b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813100b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eabec10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x17f6, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 0x26dcd8 [0091.107] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813100b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813100b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eabec10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x17f6, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.groovemui.msi.16.en-us.xml", cAlternateFileName="C26024~1.XML")) returned 0 [0091.108] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0091.108] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 1 [0091.109] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.groovemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.groovemui.msi.16.en-us.xml")) returned 0xffffffff [0091.109] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813100b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813100b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d8be5b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x15dd6, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 1 [0091.109] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.109] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0091.110] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15dd6 [0091.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0091.110] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0091.183] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x15dd6, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x15dd6, lpOverlapped=0x0) returned 1 [0091.283] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x15de0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x15de0, lpOverlapped=0x0) returned 1 [0091.287] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.353] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.366] CloseHandle (hObject=0xe4) returned 1 [0091.366] CloseHandle (hObject=0xe8) returned 1 [0091.368] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0091.369] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0091.369] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813100b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813100b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d8be5b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x15dd6, dwReserved0=0x26eee0, dwReserved1=0x18f0ac, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 0x26dcd8 [0091.369] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x813100b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x813100b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d8be5b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x15dd6, dwReserved0=0x26eee0, dwReserved1=0x18f0ac, cFileName="C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml", cAlternateFileName="C25956~1.XML")) returned 0 [0091.369] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0091.369] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 1 [0091.371] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Lync.Lync.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lync.lync.x-none.msi.16.x-none.xml")) returned 0xffffffff [0091.371] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x812e9f50, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x812e9f50, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e941e50, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5b20, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 1 [0091.371] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0091.372] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.472] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5b20 [0091.472] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0091.473] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0091.532] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5b20, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x5b20, lpOverlapped=0x0) returned 1 [0091.550] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x5b30, lpOverlapped=0x0) returned 1 [0091.552] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.613] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.627] CloseHandle (hObject=0xe8) returned 1 [0091.628] CloseHandle (hObject=0xe4) returned 1 [0091.629] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.ozq0")) returned 0 [0091.630] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0091.630] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x812e9f50, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x812e9f50, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e941e50, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5b20, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 0x26dcd8 [0091.630] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x812e9f50, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x812e9f50, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e941e50, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5b20, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.lyncmui.msi.16.en-us.xml", cAlternateFileName="C2FCD6~1.XML")) returned 0 [0091.630] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0091.630] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 1 [0091.631] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.lyncmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.lyncmui.msi.16.en-us.xml")) returned 0xffffffff [0091.631] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eb57190, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x55c2, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.office64mui.msi.16.en-us.xml", cAlternateFileName="C26643~1.XML")) returned 1 [0091.631] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64mui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.632] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64mui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64mui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0091.632] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55c2 [0091.632] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0091.633] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0091.726] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x55c2, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x55c2, lpOverlapped=0x0) returned 1 [0091.796] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x55d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x55d0, lpOverlapped=0x0) returned 1 [0091.800] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0091.862] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0091.873] CloseHandle (hObject=0xe4) returned 1 [0091.873] CloseHandle (hObject=0xe8) returned 1 [0091.875] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64mui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64mui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64mui.msi.16.en-us.xml.ozq0")) returned 0 [0091.876] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64mui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64mui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0091.876] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64mui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eb57190, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x55c2, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.office64mui.msi.16.en-us.xml", cAlternateFileName="C26643~1.XML")) returned 0x26dcd8 [0091.876] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eb57190, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x55c2, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.office64mui.msi.16.en-us.xml", cAlternateFileName="C26643~1.XML")) returned 0 [0091.876] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0091.877] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64mui.msi.16.en-us.xml")) returned 1 [0091.878] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64mui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64mui.msi.16.en-us.xml")) returned 0xffffffff [0091.878] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eb0aed0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.office64muiset.msi.16.en-us.xml", cAlternateFileName="C2755E~1.XML")) returned 1 [0091.879] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64muiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64muiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0091.879] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64muiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64muiset.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0091.880] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fa [0091.880] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0091.880] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0091.942] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x7fa, lpOverlapped=0x0) returned 1 [0091.944] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x800, lpOverlapped=0x0) returned 1 [0091.945] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.004] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.015] CloseHandle (hObject=0xe8) returned 1 [0092.016] CloseHandle (hObject=0xe4) returned 1 [0092.017] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64muiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64muiset.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64muiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64muiset.msi.16.en-us.xml.ozq0")) returned 0 [0092.018] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64muiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64muiset.msi.16.en-us.xml.ozq0")) returned 0x2020 [0092.018] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64muiset.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eb0aed0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.office64muiset.msi.16.en-us.xml", cAlternateFileName="C2755E~1.XML")) returned 0x26dcd8 [0092.018] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7eb0aed0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.office64muiset.msi.16.en-us.xml", cAlternateFileName="C2755E~1.XML")) returned 0 [0092.018] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0092.018] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64muiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64muiset.msi.16.en-us.xml")) returned 1 [0092.020] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64muiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64muiset.msi.16.en-us.xml")) returned 0xffffffff [0092.020] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7db45d10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x414c2, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.office64ww.msi.16.x-none.xml", cAlternateFileName="C2A036~1.XML")) returned 1 [0092.020] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64ww.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.020] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64ww.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64ww.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0092.020] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x414c2 [0092.020] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0092.021] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0092.091] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x414c2, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x414c2, lpOverlapped=0x0) returned 1 [0092.193] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x414d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x414d0, lpOverlapped=0x0) returned 1 [0092.201] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.257] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.272] CloseHandle (hObject=0xe4) returned 1 [0092.272] CloseHandle (hObject=0xe8) returned 1 [0092.276] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64ww.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64ww.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64ww.msi.16.x-none.xml.ozq0")) returned 0 [0092.277] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64ww.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64ww.msi.16.x-none.xml.ozq0")) returned 0x2020 [0092.277] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64ww.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7db45d10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x414c2, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.office64ww.msi.16.x-none.xml", cAlternateFileName="C2A036~1.XML")) returned 0x26dcd8 [0092.277] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81277b30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81277b30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7db45d10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x414c2, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.office64ww.msi.16.x-none.xml", cAlternateFileName="C2A036~1.XML")) returned 0 [0092.277] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0092.278] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64ww.msi.16.x-none.xml")) returned 1 [0092.283] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.office64ww.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.office64ww.msi.16.x-none.xml")) returned 0xffffffff [0092.283] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8122b870, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8122b870, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f59b070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1a182, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 1 [0092.283] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0092.283] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.284] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a182 [0092.284] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0092.284] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0092.357] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1a182, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1a182, lpOverlapped=0x0) returned 1 [0092.426] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1a190, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1a190, lpOverlapped=0x0) returned 1 [0092.429] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.497] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.510] CloseHandle (hObject=0xe8) returned 1 [0092.510] CloseHandle (hObject=0xe4) returned 1 [0092.512] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.ozq0")) returned 0 [0092.512] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0092.512] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8122b870, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8122b870, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f59b070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1a182, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 0x26dcd8 [0092.513] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8122b870, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8122b870, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f59b070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1a182, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.officemui.msi.16.en-us.xml", cAlternateFileName="C29059~1.XML")) returned 0 [0092.513] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0092.513] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 1 [0092.514] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemui.msi.16.en-us.xml")) returned 0xffffffff [0092.514] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81205710, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81205710, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f208f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 1 [0092.515] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.515] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0092.515] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fa [0092.515] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0092.516] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0092.579] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x7fa, lpOverlapped=0x0) returned 1 [0092.722] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x800, lpOverlapped=0x0) returned 1 [0092.724] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.787] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.800] CloseHandle (hObject=0xe4) returned 1 [0092.801] CloseHandle (hObject=0xe8) returned 1 [0092.802] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.ozq0")) returned 0 [0092.803] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml.ozq0")) returned 0x2020 [0092.803] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81205710, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81205710, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f208f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 0x26dcd8 [0092.803] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81205710, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81205710, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f208f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.officemuiset.msi.16.en-us.xml", cAlternateFileName="C2467F~1.XML")) returned 0 [0092.803] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0092.803] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 1 [0092.804] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.officemuiset.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.officemuiset.msi.16.en-us.xml")) returned 0xffffffff [0092.804] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811df5b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811df5b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dc9c970, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 1 [0092.805] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0092.805] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.805] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x176c8 [0092.805] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0092.806] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0092.861] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x176c8, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x176c8, lpOverlapped=0x0) returned 1 [0092.867] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x176d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x176d0, lpOverlapped=0x0) returned 1 [0092.869] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0092.929] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0092.945] CloseHandle (hObject=0xe8) returned 1 [0092.945] CloseHandle (hObject=0xe4) returned 1 [0092.951] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0092.951] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0092.951] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811df5b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811df5b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dc9c970, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x26eef0, dwReserved1=0x18f0ac, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 0x26dcd8 [0092.952] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811df5b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811df5b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dc9c970, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x26eef0, dwReserved1=0x18f0ac, cFileName="C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml", cAlternateFileName="C21839~1.XML")) returned 0 [0092.952] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0092.952] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 1 [0092.954] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenote.onenote.x-none.msi.16.x-none.xml")) returned 0xffffffff [0092.954] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811932f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811932f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ed6c4d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4a1a, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 1 [0092.954] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0092.955] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0092.955] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4a1a [0092.955] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0092.956] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0093.024] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4a1a, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x4a1a, lpOverlapped=0x0) returned 1 [0093.042] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4a20, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x4a20, lpOverlapped=0x0) returned 1 [0093.043] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.101] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.113] CloseHandle (hObject=0xe4) returned 1 [0093.113] CloseHandle (hObject=0xe8) returned 1 [0093.115] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.ozq0")) returned 0 [0093.115] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0093.115] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811932f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811932f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ed6c4d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4a1a, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 0x26dcd8 [0093.116] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811932f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811932f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ed6c4d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4a1a, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.onenotemui.msi.16.en-us.xml", cAlternateFileName="C24C3D~1.XML")) returned 0 [0093.116] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0093.116] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 1 [0093.117] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.onenotemui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.onenotemui.msi.16.en-us.xml")) returned 0xffffffff [0093.117] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811932f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811932f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7da87630, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 1 [0093.117] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0093.117] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.118] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ee [0093.118] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0093.118] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0093.190] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5ee, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x5ee, lpOverlapped=0x0) returned 1 [0093.232] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x5f0, lpOverlapped=0x0) returned 1 [0093.233] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.291] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.302] CloseHandle (hObject=0xe8) returned 1 [0093.303] CloseHandle (hObject=0xe4) returned 1 [0093.304] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0093.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0093.304] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811932f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811932f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7da87630, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x26eee0, dwReserved1=0x18f0ac, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 0x26dcd8 [0093.304] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x811932f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x811932f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7da87630, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5ee, dwReserved0=0x26eee0, dwReserved1=0x18f0ac, cFileName="C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml", cAlternateFileName="C24EFF~1.XML")) returned 0 [0093.305] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0093.305] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 1 [0093.306] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSM.OSM.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osm.osm.x-none.msi.16.x-none.xml")) returned 0xffffffff [0093.306] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ecaddf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2b14, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 1 [0093.306] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.306] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0093.307] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2b14 [0093.307] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0093.307] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0093.362] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2b14, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x2b14, lpOverlapped=0x0) returned 1 [0093.653] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2b20, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x2b20, lpOverlapped=0x0) returned 1 [0093.654] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.711] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.723] CloseHandle (hObject=0xe4) returned 1 [0093.724] CloseHandle (hObject=0xe8) returned 1 [0093.725] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.ozq0")) returned 0 [0093.725] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0093.726] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ecaddf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2b14, dwReserved0=0x26eec8, dwReserved1=0x18f0ac, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 0x26dcd8 [0093.726] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7ecaddf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2b14, dwReserved0=0x26eec8, dwReserved1=0x18f0ac, cFileName="C2RManifest.osmmui.msi.16.en-us.xml", cAlternateFileName="C25F09~1.XML")) returned 0 [0093.726] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0093.726] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 1 [0093.728] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmmui.msi.16.en-us.xml")) returned 0xffffffff [0093.728] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7daad790, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 1 [0093.728] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0093.728] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.729] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8fa [0093.729] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0093.729] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0093.795] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8fa, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x8fa, lpOverlapped=0x0) returned 1 [0093.816] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x900, lpOverlapped=0x0) returned 1 [0093.818] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0093.875] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0093.886] CloseHandle (hObject=0xe8) returned 1 [0093.886] CloseHandle (hObject=0xe4) returned 1 [0093.888] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0093.888] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0093.888] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7daad790, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 0x26dcd8 [0093.888] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7daad790, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml", cAlternateFileName="C22C6F~1.XML")) returned 0 [0093.888] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0093.889] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 1 [0093.890] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmux.osmux.x-none.msi.16.x-none.xml")) returned 0xffffffff [0093.890] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f659750, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2698, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 1 [0093.890] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0093.891] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0093.891] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2698 [0093.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0093.891] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0093.950] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2698, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x2698, lpOverlapped=0x0) returned 1 [0094.022] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x26a0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x26a0, lpOverlapped=0x0) returned 1 [0094.023] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.081] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.094] CloseHandle (hObject=0xe4) returned 1 [0094.094] CloseHandle (hObject=0xe8) returned 1 [0094.095] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.ozq0")) returned 0 [0094.095] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0094.095] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f659750, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2698, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 0x26dcd8 [0094.095] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f659750, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2698, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.osmuxmui.msi.16.en-us.xml", cAlternateFileName="C21C45~1.XML")) returned 0 [0094.095] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0094.096] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 1 [0094.097] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.osmuxmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.osmuxmui.msi.16.en-us.xml")) returned 0xffffffff [0094.097] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7da3b370, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x16c9a, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 1 [0094.097] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0094.097] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.097] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16c9a [0094.097] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0094.098] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0094.155] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x16c9a, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x16c9a, lpOverlapped=0x0) returned 1 [0094.300] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x16ca0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x16ca0, lpOverlapped=0x0) returned 1 [0094.304] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.369] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.383] CloseHandle (hObject=0xe8) returned 1 [0094.384] CloseHandle (hObject=0xe4) returned 1 [0094.391] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0094.391] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0094.391] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7da3b370, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x16c9a, dwReserved0=0x26eef0, dwReserved1=0x18f0ac, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 0x26dcd8 [0094.392] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8116d190, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8116d190, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7da3b370, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x16c9a, dwReserved0=0x26eef0, dwReserved1=0x18f0ac, cFileName="C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml", cAlternateFileName="C29151~1.XML")) returned 0 [0094.392] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0094.392] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 1 [0094.393] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Outlook.Outlook.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlook.outlook.x-none.msi.16.x-none.xml")) returned 0xffffffff [0094.393] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81147030, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81147030, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f385d30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x178c4, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 1 [0094.394] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.394] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0094.394] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x178c4 [0094.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0094.395] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0094.450] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x178c4, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x178c4, lpOverlapped=0x0) returned 1 [0094.471] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x178d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x178d0, lpOverlapped=0x0) returned 1 [0094.474] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.532] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.547] CloseHandle (hObject=0xe4) returned 1 [0094.547] CloseHandle (hObject=0xe8) returned 1 [0094.549] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.ozq0")) returned 0 [0094.549] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0094.549] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81147030, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81147030, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f385d30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x178c4, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 0x26dcd8 [0094.550] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81147030, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81147030, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f385d30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x178c4, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.outlookmui.msi.16.en-us.xml", cAlternateFileName="C2C4E2~1.XML")) returned 0 [0094.550] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0094.550] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 1 [0094.551] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.outlookmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.outlookmui.msi.16.en-us.xml")) returned 0xffffffff [0094.552] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x810d4c10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x810d4c10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d9ef0b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xadce8, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 1 [0094.552] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0094.552] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.553] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadce8 [0094.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0094.553] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0094.612] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xadce8, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xadce8, lpOverlapped=0x0) returned 1 [0094.640] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xadcf0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xadcf0, lpOverlapped=0x0) returned 1 [0094.654] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.719] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.733] CloseHandle (hObject=0xe8) returned 1 [0094.733] CloseHandle (hObject=0xe4) returned 1 [0094.745] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0094.745] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0094.746] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x810d4c10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x810d4c10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d9ef0b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xadce8, dwReserved0=0x26eef8, dwReserved1=0x18f0ac, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 0x26dcd8 [0094.746] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x810d4c10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x810d4c10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7d9ef0b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xadce8, dwReserved0=0x26eef8, dwReserved1=0x18f0ac, cFileName="C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml", cAlternateFileName="C280EB~1.XML")) returned 0 [0094.746] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0094.746] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 1 [0094.754] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpivot.powerpivot.x-none.msi.16.x-none.xml")) returned 0xffffffff [0094.755] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8103c690, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8103c690, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fb1c350, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x19170, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 1 [0094.755] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.755] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0094.755] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19170 [0094.756] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0094.756] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0094.829] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x19170, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x19170, lpOverlapped=0x0) returned 1 [0094.863] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x19180, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x19180, lpOverlapped=0x0) returned 1 [0094.866] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0094.931] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0094.946] CloseHandle (hObject=0xe4) returned 1 [0094.946] CloseHandle (hObject=0xe8) returned 1 [0094.949] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0094.949] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0094.949] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8103c690, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8103c690, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fb1c350, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x19170, dwReserved0=0x26eef8, dwReserved1=0x18f0ac, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 0x26dcd8 [0094.950] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8103c690, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8103c690, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fb1c350, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x19170, dwReserved0=0x26eef8, dwReserved1=0x18f0ac, cFileName="C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml", cAlternateFileName="C222CA~1.XML")) returned 0 [0094.950] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0094.950] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 1 [0094.952] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpoint.powerpoint.x-none.msi.16.x-none.xml")) returned 0xffffffff [0094.952] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8103c690, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8103c690, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f4b6830, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x684e, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 1 [0094.953] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0094.953] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0094.954] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x684e [0094.954] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0094.954] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0095.021] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x684e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x684e, lpOverlapped=0x0) returned 1 [0095.024] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x6850, lpOverlapped=0x0) returned 1 [0095.025] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.084] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.098] CloseHandle (hObject=0xe8) returned 1 [0095.098] CloseHandle (hObject=0xe4) returned 1 [0095.099] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.ozq0")) returned 0 [0095.100] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0095.100] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8103c690, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8103c690, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f4b6830, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x684e, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 0x26dcd8 [0095.100] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8103c690, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x8103c690, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f4b6830, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x684e, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.powerpointmui.msi.16.en-us.xml", cAlternateFileName="C27FF4~1.XML")) returned 0 [0095.100] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0095.100] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 1 [0095.102] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.powerpointmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.powerpointmui.msi.16.en-us.xml")) returned 0xffffffff [0095.102] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f9532d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x636e, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 1 [0095.102] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.103] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0095.103] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x636e [0095.103] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0095.104] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0095.172] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x636e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x636e, lpOverlapped=0x0) returned 1 [0095.185] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6370, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x6370, lpOverlapped=0x0) returned 1 [0095.186] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.250] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.265] CloseHandle (hObject=0xe4) returned 1 [0095.265] CloseHandle (hObject=0xe8) returned 1 [0095.267] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.ozq0")) returned 0 [0095.267] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml.ozq0")) returned 0x2020 [0095.268] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f9532d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x636e, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 0x26dcd8 [0095.268] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f9532d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x636e, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Proof.Culture.msi.16.en-us.xml", cAlternateFileName="C2B3EB~1.XML")) returned 0 [0095.268] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0095.268] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 1 [0095.269] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.en-us.xml")) returned 0xffffffff [0095.270] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f8bad50, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5fa6, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 1 [0095.270] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0095.270] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.271] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fa6 [0095.271] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0095.271] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0095.338] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5fa6, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x5fa6, lpOverlapped=0x0) returned 1 [0095.341] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5fb0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x5fb0, lpOverlapped=0x0) returned 1 [0095.343] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.405] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.419] CloseHandle (hObject=0xe8) returned 1 [0095.419] CloseHandle (hObject=0xe4) returned 1 [0095.420] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.ozq0")) returned 0 [0095.421] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml.ozq0")) returned 0x2020 [0095.421] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f8bad50, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5fa6, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 0x26dcd8 [0095.421] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f8bad50, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5fa6, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Proof.Culture.msi.16.es-es.xml", cAlternateFileName="C23127~1.XML")) returned 0 [0095.421] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0095.421] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 1 [0095.423] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.es-es.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.es-es.xml")) returned 0xffffffff [0095.423] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f907010, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5fa6, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 1 [0095.423] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.423] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0095.424] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5fa6 [0095.424] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0095.424] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0095.490] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5fa6, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x5fa6, lpOverlapped=0x0) returned 1 [0095.492] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5fb0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x5fb0, lpOverlapped=0x0) returned 1 [0095.493] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.550] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.566] CloseHandle (hObject=0xe4) returned 1 [0095.566] CloseHandle (hObject=0xe8) returned 1 [0095.568] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.ozq0")) returned 0 [0095.568] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml.ozq0")) returned 0x2020 [0095.568] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f907010, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5fa6, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 0x26dcd8 [0095.569] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f907010, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x5fa6, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Proof.Culture.msi.16.fr-fr.xml", cAlternateFileName="C2BAB3~1.XML")) returned 0 [0095.569] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0095.569] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 1 [0095.570] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Proof.Culture.msi.16.fr-fr.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proof.culture.msi.16.fr-fr.xml")) returned 0xffffffff [0095.570] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f7640f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 1 [0095.571] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0095.571] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.571] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7fa [0095.572] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0095.572] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0095.645] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7fa, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x7fa, lpOverlapped=0x0) returned 1 [0095.647] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x800, lpOverlapped=0x0) returned 1 [0095.648] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.708] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.734] CloseHandle (hObject=0xe8) returned 1 [0095.734] CloseHandle (hObject=0xe4) returned 1 [0095.735] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.ozq0")) returned 0 [0095.735] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml.ozq0")) returned 0x2020 [0095.735] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f7640f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 0x26dcd8 [0095.736] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f7640f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x7fa, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.proofing.msi.16.en-us.xml", cAlternateFileName="C24618~1.XML")) returned 0 [0095.736] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0095.736] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 1 [0095.737] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.proofing.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.proofing.msi.16.en-us.xml")) returned 0xffffffff [0095.737] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dd0ed90, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x12d6e, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 1 [0095.737] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.737] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0095.738] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12d6e [0095.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0095.738] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0095.805] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12d6e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x12d6e, lpOverlapped=0x0) returned 1 [0095.809] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12d70, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x12d70, lpOverlapped=0x0) returned 1 [0095.811] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0095.873] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0095.886] CloseHandle (hObject=0xe4) returned 1 [0095.887] CloseHandle (hObject=0xe8) returned 1 [0095.889] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0095.890] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0095.890] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dd0ed90, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x12d6e, dwReserved0=0x26eef8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 0x26dcd8 [0095.890] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x81016530, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x81016530, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dd0ed90, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x12d6e, dwReserved0=0x26eef8, dwReserved1=0x18f0ac, cFileName="C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml", cAlternateFileName="C2C6D1~1.XML")) returned 0 [0095.890] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0095.890] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 1 [0095.892] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Publisher.Publisher.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publisher.publisher.x-none.msi.16.x-none.xml")) returned 0xffffffff [0095.892] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ff03d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80ff03d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f848930, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3708, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 1 [0095.892] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0095.892] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0095.893] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3708 [0095.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0095.893] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0095.958] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3708, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x3708, lpOverlapped=0x0) returned 1 [0095.961] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x3710, lpOverlapped=0x0) returned 1 [0095.962] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.018] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.032] CloseHandle (hObject=0xe8) returned 1 [0096.033] CloseHandle (hObject=0xe4) returned 1 [0096.034] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.ozq0")) returned 0 [0096.034] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0096.034] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ff03d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80ff03d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f848930, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3708, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 0x26dcd8 [0096.035] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ff03d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80ff03d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7f848930, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3708, dwReserved0=0x26eed8, dwReserved1=0x18f0ac, cFileName="C2RManifest.publishermui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~4.XML")) returned 0 [0096.035] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0096.035] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 1 [0096.036] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.publishermui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.publishermui.msi.16.en-us.xml")) returned 0xffffffff [0096.036] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80f57e50, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80f57e50, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dd5b050, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xaac34, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 1 [0096.036] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.037] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0096.037] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaac34 [0096.037] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0096.037] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0096.102] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xaac34, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xaac34, lpOverlapped=0x0) returned 1 [0096.159] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xaac40, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xaac40, lpOverlapped=0x0) returned 1 [0096.191] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.250] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.265] CloseHandle (hObject=0xe4) returned 1 [0096.265] CloseHandle (hObject=0xe8) returned 1 [0096.304] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0096.304] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0096.304] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80f57e50, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80f57e50, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dd5b050, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xaac34, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 0x26dcd8 [0096.305] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80f57e50, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80f57e50, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7dd5b050, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xaac34, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="C2RManifest.shared.Office.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~3.XML")) returned 0 [0096.305] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0096.305] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 1 [0096.312] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.shared.Office.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.shared.office.x-none.msi.16.x-none.xml")) returned 0xffffffff [0096.313] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ebf8d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80ebf8d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e008910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x15286, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 1 [0096.313] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0096.313] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.313] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15286 [0096.313] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0096.314] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0096.376] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x15286, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x15286, lpOverlapped=0x0) returned 1 [0096.380] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x15290, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x15290, lpOverlapped=0x0) returned 1 [0096.382] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.452] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.468] CloseHandle (hObject=0xe8) returned 1 [0096.468] CloseHandle (hObject=0xe4) returned 1 [0096.472] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.ozq0")) returned 0 [0096.472] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml.ozq0")) returned 0x2020 [0096.472] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ebf8d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80ebf8d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e008910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x15286, dwReserved0=0x26eee0, dwReserved1=0x18f0ac, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 0x26dcd8 [0096.473] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80ebf8d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80ebf8d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7e008910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x15286, dwReserved0=0x26eee0, dwReserved1=0x18f0ac, cFileName="C2RManifest.Word.Word.x-none.msi.16.x-none.xml", cAlternateFileName="C2RMAN~2.XML")) returned 0 [0096.473] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0096.473] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 1 [0096.474] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.Word.Word.x-none.msi.16.x-none.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.word.word.x-none.msi.16.x-none.xml")) returned 0xffffffff [0096.475] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80e99770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80e99770, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7faf61f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1301e, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 1 [0096.475] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.475] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0096.475] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1301e [0096.475] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0096.476] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0096.538] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1301e, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1301e, lpOverlapped=0x0) returned 1 [0096.551] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13020, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x13020, lpOverlapped=0x0) returned 1 [0096.554] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.611] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.628] CloseHandle (hObject=0xe4) returned 1 [0096.628] CloseHandle (hObject=0xe8) returned 1 [0096.629] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.ozq0")) returned 0 [0096.630] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml.ozq0")) returned 0x2020 [0096.630] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80e99770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80e99770, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7faf61f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1301e, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 0x26dcd8 [0096.630] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80e99770, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80e99770, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7faf61f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1301e, dwReserved0=0x26eed0, dwReserved1=0x18f0ac, cFileName="C2RManifest.wordmui.msi.16.en-us.xml", cAlternateFileName="C2RMAN~1.XML")) returned 0 [0096.630] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0096.630] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 1 [0096.632] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\C2RManifest.wordmui.msi.16.en-us.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\c2rmanifest.wordmui.msi.16.en-us.xml")) returned 0xffffffff [0096.632] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80e27350, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80e27350, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fda3ab0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xd1e70, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0096.632] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0096.632] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.633] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1e70 [0096.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0096.633] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0096.689] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd1e70, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xd1e70, lpOverlapped=0x0) returned 1 [0096.734] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd1e80, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xd1e80, lpOverlapped=0x0) returned 1 [0096.757] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0096.813] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0096.825] CloseHandle (hObject=0xe8) returned 1 [0096.825] CloseHandle (hObject=0xe4) returned 1 [0096.868] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.ozq0")) returned 0 [0096.868] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe.ozq0")) returned 0x2020 [0096.868] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80e27350, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80e27350, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fda3ab0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xd1e70, dwReserved0=0x26eea0, dwReserved1=0x18f0ac, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 0x26dcd8 [0096.869] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x80e27350, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x80e27350, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x7fda3ab0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0xd1e70, dwReserved0=0x26eea0, dwReserved1=0x18f0ac, cFileName="integrator.exe", cAlternateFileName="INTEGR~1.EXE")) returned 0 [0096.869] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0096.869] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe")) returned 1 [0096.879] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\integrator.exe" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\integrator.exe")) returned 0xffffffff [0096.879] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2d2a850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd2d2a850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd2d2a850, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0096.879] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0096.879] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0096.879] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcf4 [0096.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0096.880] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0096.942] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xcf4, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xcf4, lpOverlapped=0x0) returned 1 [0096.943] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xd00, lpOverlapped=0x0) returned 1 [0096.944] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.001] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.013] CloseHandle (hObject=0xe4) returned 1 [0097.013] CloseHandle (hObject=0xe8) returned 1 [0097.015] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.ozq0")) returned 0 [0097.015] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml.ozq0")) returned 0x2020 [0097.015] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2d2a850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd2d2a850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd2d2a850, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x26eef0, dwReserved1=0x18f0ac, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 0x26dcd8 [0097.015] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd2d2a850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd2d2a850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd2d2a850, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x26eef0, dwReserved1=0x18f0ac, cFileName="Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml", cAlternateFileName="MICROS~2.XML")) returned 0 [0097.015] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0097.015] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 1 [0097.017] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentFallBack2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentfallback2016.xml")) returned 0xffffffff [0097.017] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd230cad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd230cad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd230cad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xcb2, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0097.017] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0097.017] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.017] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb2 [0097.018] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0097.018] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0097.079] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xcb2, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xcb2, lpOverlapped=0x0) returned 1 [0097.080] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xcc0, lpOverlapped=0x0) returned 1 [0097.081] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.138] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.153] CloseHandle (hObject=0xe8) returned 1 [0097.153] CloseHandle (hObject=0xe4) returned 1 [0097.154] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.ozq0")) returned 0 [0097.155] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml.ozq0")) returned 0x2020 [0097.155] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd230cad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd230cad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd230cad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xcb2, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 0x26dcd8 [0097.155] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd230cad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd230cad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd230cad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xcb2, dwReserved0=0x26eee8, dwReserved1=0x18f0ac, cFileName="Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0097.155] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0097.155] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 1 [0097.156] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\Microsoft_Office_OfficeTelemetryAgentLogOn2016.xml" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\microsoft_office_officetelemetryagentlogon2016.xml")) returned 0xffffffff [0097.156] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd72cabd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd72cabd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xc2003070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 1 [0097.156] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.157] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0097.157] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b826 [0097.157] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0097.157] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0097.236] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1b826, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1b826, lpOverlapped=0x0) returned 1 [0097.245] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1b830, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1b830, lpOverlapped=0x0) returned 1 [0097.248] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0097.313] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0097.329] CloseHandle (hObject=0xe4) returned 1 [0097.329] CloseHandle (hObject=0xe8) returned 1 [0097.331] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.ozq0")) returned 0 [0097.332] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man.ozq0")) returned 0x2020 [0097.332] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd72cabd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd72cabd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xc2003070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x26eea8, dwReserved1=0x18f0ac, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 0x26dcd8 [0097.332] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd72cabd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd72cabd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xc2003070, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x1b826, dwReserved0=0x26eea8, dwReserved1=0x18f0ac, cFileName="msoutilstat.etw.man", cAlternateFileName="MSOUTI~1.MAN")) returned 0 [0097.332] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0097.333] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man")) returned 1 [0097.335] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\msoutilstat.etw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\msoutilstat.etw.man")) returned 0xffffffff [0097.335] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6162af0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd6162af0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xc7a77470, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="wordEtw.man", cAlternateFileName="")) returned 1 [0097.335] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0097.335] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0097.336] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9bddd [0097.336] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0097.336] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0097.407] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9bddd, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x9bddd, lpOverlapped=0x0) returned 1 [0097.443] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9bde0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x9bde0, lpOverlapped=0x0) returned 1 [0098.348] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.411] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.425] CloseHandle (hObject=0xe8) returned 1 [0098.425] CloseHandle (hObject=0xe4) returned 1 [0098.472] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.ozq0")) returned 0 [0098.473] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man.ozq0" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man.ozq0")) returned 0x2020 [0098.473] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6162af0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd6162af0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xc7a77470, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x26ee98, dwReserved1=0x18f0ac, cFileName="wordEtw.man", cAlternateFileName="")) returned 0x26dcd8 [0098.473] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6162af0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd6162af0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xc7a77470, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x26ee98, dwReserved1=0x18f0ac, cFileName="wordEtw.man", cAlternateFileName="")) returned 0 [0098.473] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0098.473] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man")) returned 1 [0098.481] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\ClickToRun\\{9AC08E99-230B-47e8-9721-4577B7F124EA}\\wordEtw.man" (normalized: "c:\\users\\all users\\microsoft\\clicktorun\\{9ac08e99-230b-47e8-9721-4577b7f124ea}\\wordetw.man")) returned 0xffffffff [0098.481] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6162af0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd6162af0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xc7a77470, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9bddd, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="wordEtw.man", cAlternateFileName="")) returned 0 [0098.481] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0098.482] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80e27350, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xd7956850, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd7956850, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0098.482] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0098.482] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38653734, cFileName="Crypto", cAlternateFileName="")) returned 1 [0098.482] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0098.482] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName="..", cAlternateFileName="")) returned 1 [0098.482] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName="DSS", cAlternateFileName="")) returned 1 [0098.482] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd38 [0098.483] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0098.483] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0098.483] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0098.483] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0098.483] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0098.483] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0098.483] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0098.483] FindClose (in: hFindFile=0x26dd38 | out: hFindFile=0x26dd38) returned 1 [0098.483] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName="Keys", cAlternateFileName="")) returned 1 [0098.483] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0098.484] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0098.484] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 0 [0098.484] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0098.484] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName="RSA", cAlternateFileName="")) returned 1 [0098.484] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd38 [0098.484] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0098.484] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0098.484] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0098.485] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0098.485] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0098.485] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0098.485] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0098.485] FindClose (in: hFindFile=0x26dd38 | out: hFindFile=0x26dd38) returned 1 [0098.485] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName="RSA", cAlternateFileName="")) returned 0 [0098.485] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0098.485] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38653734, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0098.485] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0098.485] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName="..", cAlternateFileName="")) returned 1 [0098.486] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7774652e, dwReserved1=0x6e616d2e, cFileName="Device", cAlternateFileName="")) returned 1 [0098.486] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd50 [0098.486] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0098.486] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0098.486] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0098.641] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0098.641] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="background.png", cAlternateFileName="")) returned 1 [0098.642] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0098.642] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0098.643] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0098.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0098.643] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0098.699] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1fad1, lpOverlapped=0x0) returned 1 [0098.737] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x1fae0, lpOverlapped=0x0) returned 1 [0098.740] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0098.794] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0098.843] CloseHandle (hObject=0xe8) returned 1 [0098.843] CloseHandle (hObject=0xf0) returned 1 [0098.848] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ozq0")) returned 0 [0098.850] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png.ozq0")) returned 0x20 [0098.850] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="background.png", cAlternateFileName="")) returned 0x26fe78 [0098.850] FindNextFileA (in: hFindFile=0x26fe78, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="background.png", cAlternateFileName="")) returned 0 [0098.850] FindClose (in: hFindFile=0x26fe78 | out: hFindFile=0x26fe78) returned 1 [0098.850] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0 [0098.850] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png")) returned 0x20 [0098.851] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0098.851] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0098.853] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0098.854] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb61 [0098.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0098.855] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0098.917] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xb61, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xb61, lpOverlapped=0x0) returned 1 [0098.941] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xb70, lpOverlapped=0x0) returned 1 [0098.943] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.002] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.016] CloseHandle (hObject=0xf0) returned 1 [0099.016] CloseHandle (hObject=0xe8) returned 1 [0099.017] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.ozq0")) returned 0 [0099.018] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml.ozq0")) returned 0x20 [0099.018] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="behavior.xml", cAlternateFileName="")) returned 0x26fe78 [0099.018] FindNextFileA (in: hFindFile=0x26fe78, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7c5b0d9, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xc7c5b0d9, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xc7c5b0d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xb61, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="behavior.xml", cAlternateFileName="")) returned 0 [0099.018] FindClose (in: hFindFile=0x26fe78 | out: hFindFile=0x26fe78) returned 1 [0099.018] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0 [0099.018] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\behavior.xml")) returned 0x20 [0099.018] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="device.png", cAlternateFileName="")) returned 1 [0099.018] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0099.019] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0099.019] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xadc8 [0099.019] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0099.019] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0099.076] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xadc8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xadc8, lpOverlapped=0x0) returned 1 [0099.127] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xadd0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xadd0, lpOverlapped=0x0) returned 1 [0099.129] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.188] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.205] CloseHandle (hObject=0xe8) returned 1 [0099.205] CloseHandle (hObject=0xf0) returned 1 [0099.207] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.ozq0")) returned 0 [0099.207] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png.ozq0")) returned 0x20 [0099.207] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="device.png", cAlternateFileName="")) returned 0x26fe70 [0099.207] FindNextFileA (in: hFindFile=0x26fe70, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f07a66f, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f07a66f, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76b3ce5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xadc8, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="device.png", cAlternateFileName="")) returned 0 [0099.207] FindClose (in: hFindFile=0x26fe70 | out: hFindFile=0x26fe70) returned 1 [0099.207] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0 [0099.208] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\device.png")) returned 0x20 [0099.208] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="overlay.png", cAlternateFileName="")) returned 1 [0099.208] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0099.208] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0099.209] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0099.209] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0099.209] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0099.264] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x70c1, lpOverlapped=0x0) returned 1 [0099.375] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x70d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x70d0, lpOverlapped=0x0) returned 1 [0099.377] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.440] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.452] CloseHandle (hObject=0xf0) returned 1 [0099.452] CloseHandle (hObject=0xe8) returned 1 [0099.453] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.ozq0")) returned 0 [0099.454] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png.ozq0")) returned 0x20 [0099.454] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="overlay.png", cAlternateFileName="")) returned 0x26fe70 [0099.454] FindNextFileA (in: hFindFile=0x26fe70, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0a07cc, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0a07cc, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="overlay.png", cAlternateFileName="")) returned 0 [0099.454] FindClose (in: hFindFile=0x26fe70 | out: hFindFile=0x26fe70) returned 1 [0099.454] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0 [0099.454] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\overlay.png")) returned 0x20 [0099.454] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="superbar.png", cAlternateFileName="")) returned 1 [0099.454] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0099.456] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0099.457] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99d3 [0099.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0099.457] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0099.517] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x99d3, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x99d3, lpOverlapped=0x0) returned 1 [0099.606] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x99e0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x99e0, lpOverlapped=0x0) returned 1 [0099.608] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.672] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.687] CloseHandle (hObject=0xe8) returned 1 [0099.687] CloseHandle (hObject=0xf0) returned 1 [0099.690] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.ozq0")) returned 0 [0099.690] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png.ozq0")) returned 0x20 [0099.690] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="superbar.png", cAlternateFileName="")) returned 0x26fe78 [0099.691] FindNextFileA (in: hFindFile=0x26fe78, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0099.691] FindClose (in: hFindFile=0x26fe78 | out: hFindFile=0x26fe78) returned 1 [0099.691] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0 [0099.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\superbar.png")) returned 0x20 [0099.691] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0c6929, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0c6929, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc76d9e43, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x99d3, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="superbar.png", cAlternateFileName="")) returned 0 [0099.691] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0099.692] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76676e67, dwReserved1=0x766521e5, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0099.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0099.692] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0099.692] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="background.png", cAlternateFileName="")) returned 1 [0099.692] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0099.693] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0099.696] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fad1 [0099.696] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0099.696] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0099.756] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1fad1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1fad1, lpOverlapped=0x0) returned 1 [0099.774] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1fae0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x1fae0, lpOverlapped=0x0) returned 1 [0099.777] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0099.834] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0099.858] CloseHandle (hObject=0xf0) returned 1 [0099.858] CloseHandle (hObject=0xe8) returned 1 [0099.888] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ozq0")) returned 0 [0099.888] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png.ozq0")) returned 0x20 [0099.888] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="background.png", cAlternateFileName="")) returned 0x26fe78 [0099.889] FindNextFileA (in: hFindFile=0x26fe78, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c0af2f7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x9c0af2f7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x9c0af2f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1fad1, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="background.png", cAlternateFileName="")) returned 0 [0099.889] FindClose (in: hFindFile=0x26fe78 | out: hFindFile=0x26fe78) returned 1 [0099.889] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0 [0099.889] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0099.889] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="behavior.xml", cAlternateFileName="")) returned 1 [0099.889] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0099.890] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0099.890] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x769 [0099.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0099.891] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0099.975] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x769, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x769, lpOverlapped=0x0) returned 1 [0099.977] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x770, lpOverlapped=0x0) returned 1 [0099.978] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.037] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.048] CloseHandle (hObject=0xe8) returned 1 [0100.049] CloseHandle (hObject=0xf0) returned 1 [0100.050] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.ozq0")) returned 0 [0100.050] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml.ozq0")) returned 0x20 [0100.050] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="behavior.xml", cAlternateFileName="")) returned 0x26fe78 [0100.050] FindNextFileA (in: hFindFile=0x26fe78, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2feb941, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2feb941, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x769, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="behavior.xml", cAlternateFileName="")) returned 0 [0100.050] FindClose (in: hFindFile=0x26fe78 | out: hFindFile=0x26fe78) returned 1 [0100.050] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0 [0100.051] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\behavior.xml")) returned 0x20 [0100.051] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="watermark.png", cAlternateFileName="")) returned 1 [0100.051] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0100.052] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0100.052] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70c1 [0100.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0100.052] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0100.112] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x70c1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x70c1, lpOverlapped=0x0) returned 1 [0100.114] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x70d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x70d0, lpOverlapped=0x0) returned 1 [0100.115] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.173] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.185] CloseHandle (hObject=0xf0) returned 1 [0100.185] CloseHandle (hObject=0xe8) returned 1 [0100.280] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.ozq0")) returned 0 [0100.280] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png.ozq0")) returned 0x20 [0100.281] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="watermark.png", cAlternateFileName="")) returned 0x26fe78 [0100.281] FindNextFileA (in: hFindFile=0x26fe78, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0100.281] FindClose (in: hFindFile=0x26fe78 | out: hFindFile=0x26fe78) returned 1 [0100.281] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0 [0100.281] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\watermark.png")) returned 0x20 [0100.281] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3011a9e, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd3011a9e, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x9c0d5455, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x70c1, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="watermark.png", cAlternateFileName="")) returned 0 [0100.281] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0100.282] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76676e67, dwReserved1=0x766521e5, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0100.282] FindClose (in: hFindFile=0x26dd50 | out: hFindFile=0x26dd50) returned 1 [0100.282] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 1 [0100.282] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7667676e, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0100.282] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7667676e, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0100.282] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7667676e, dwReserved1=0x766521e5, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0100.282] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0100.283] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0100.283] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="en-US", cAlternateFileName="")) returned 1 [0100.283] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe60 [0100.284] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0100.284] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0100.284] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0100.288] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0100.289] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x536 [0100.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0100.289] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0100.352] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x536, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x536, lpOverlapped=0x0) returned 1 [0100.361] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x540, lpOverlapped=0x0) returned 1 [0100.362] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.434] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.446] CloseHandle (hObject=0xf0) returned 1 [0100.446] CloseHandle (hObject=0xec) returned 1 [0100.447] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.ozq0")) returned 0 [0100.447] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml.ozq0")) returned 0x20 [0100.447] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x270f90, dwReserved1=0x18ebdc, cFileName="resource.xml", cAlternateFileName="")) returned 0x26fd98 [0100.447] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x270f90, dwReserved1=0x18ebdc, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0100.448] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0100.448] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0 [0100.448] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-us\\resource.xml")) returned 0x20 [0100.448] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0100.448] FindClose (in: hFindFile=0x26fe60 | out: hFindFile=0x26fe60) returned 1 [0100.448] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x76f7386c, dwReserved1=0x76653c7d, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0100.448] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0100.448] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0100.449] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0100.449] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0100.449] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0100.505] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xd0a3, lpOverlapped=0x0) returned 1 [0100.614] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xd0b0, lpOverlapped=0x0) returned 1 [0100.616] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.681] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.696] CloseHandle (hObject=0xe8) returned 1 [0100.696] CloseHandle (hObject=0xec) returned 1 [0100.698] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ozq0")) returned 0 [0100.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.ozq0")) returned 0x20 [0100.699] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="folder.ico", cAlternateFileName="")) returned 0x26fe68 [0100.699] FindNextFileA (in: hFindFile=0x26fe68, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c7f9e6, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c7f9e6, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0100.699] FindClose (in: hFindFile=0x26fe68 | out: hFindFile=0x26fe68) returned 1 [0100.699] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0 [0100.699] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20 [0100.700] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="netfol.ico", cAlternateFileName="")) returned 1 [0100.700] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0100.700] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0100.700] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x72ee [0100.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0100.701] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0100.770] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x72ee, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x72ee, lpOverlapped=0x0) returned 1 [0100.806] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x72f0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x72f0, lpOverlapped=0x0) returned 1 [0100.807] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0100.872] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0100.887] CloseHandle (hObject=0xec) returned 1 [0100.887] CloseHandle (hObject=0xe8) returned 1 [0100.888] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.ozq0")) returned 0 [0100.888] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico.ozq0")) returned 0x20 [0100.889] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="netfol.ico", cAlternateFileName="")) returned 0x26fe68 [0100.889] FindNextFileA (in: hFindFile=0x26fe68, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x72ee, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="netfol.ico", cAlternateFileName="")) returned 0 [0100.889] FindClose (in: hFindFile=0x26fe68 | out: hFindFile=0x26fe68) returned 1 [0100.889] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0 [0100.889] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\netfol.ico")) returned 0x20 [0100.889] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="pictures.ico", cAlternateFileName="")) returned 1 [0100.889] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0100.890] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0100.890] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14668 [0100.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0100.890] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0100.945] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x14668, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x14668, lpOverlapped=0x0) returned 1 [0100.981] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x14670, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x14670, lpOverlapped=0x0) returned 1 [0100.983] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.045] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.057] CloseHandle (hObject=0xe8) returned 1 [0101.058] CloseHandle (hObject=0xec) returned 1 [0101.059] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.ozq0")) returned 0 [0101.059] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico.ozq0")) returned 0x20 [0101.060] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="pictures.ico", cAlternateFileName="")) returned 0x26fe68 [0101.060] FindNextFileA (in: hFindFile=0x26fe68, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2ca5b43, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2ca5b43, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c10f535, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x14668, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="pictures.ico", cAlternateFileName="")) returned 0 [0101.060] FindClose (in: hFindFile=0x26fe68 | out: hFindFile=0x26fe68) returned 1 [0101.060] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0 [0101.060] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\pictures.ico")) returned 0x20 [0101.060] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0101.060] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0101.061] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0101.062] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x536 [0101.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0101.062] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0101.115] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x536, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x536, lpOverlapped=0x0) returned 1 [0101.118] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x540, lpOverlapped=0x0) returned 1 [0101.119] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.185] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.196] CloseHandle (hObject=0xec) returned 1 [0101.196] CloseHandle (hObject=0xe8) returned 1 [0101.230] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.ozq0")) returned 0 [0101.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml.ozq0")) returned 0x20 [0101.231] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="resource.xml", cAlternateFileName="")) returned 0x26fe68 [0101.231] FindNextFileA (in: hFindFile=0x26fe68, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c59889, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2c59889, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1cdc0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0101.231] FindClose (in: hFindFile=0x26fe68 | out: hFindFile=0x26fe68) returned 1 [0101.231] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0 [0101.232] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20 [0101.232] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="ringtones.ico", cAlternateFileName="")) returned 1 [0101.232] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0101.233] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0101.234] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcaa9 [0101.234] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0101.234] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0101.309] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xcaa9, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xcaa9, lpOverlapped=0x0) returned 1 [0101.311] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xcab0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xcab0, lpOverlapped=0x0) returned 1 [0101.313] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.387] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.399] CloseHandle (hObject=0xe8) returned 1 [0101.399] CloseHandle (hObject=0xec) returned 1 [0101.401] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.ozq0")) returned 0 [0101.401] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico.ozq0")) returned 0x20 [0101.401] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="ringtones.ico", cAlternateFileName="")) returned 0x26fe68 [0101.401] FindNextFileA (in: hFindFile=0x26fe68, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2cf1dfd, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2cf1dfd, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xcaa9, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="ringtones.ico", cAlternateFileName="")) returned 0 [0101.402] FindClose (in: hFindFile=0x26fe68 | out: hFindFile=0x26fe68) returned 1 [0101.402] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0 [0101.402] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\ringtones.ico")) returned 0x20 [0101.402] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="settings.ico", cAlternateFileName="")) returned 1 [0101.402] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0101.402] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0101.403] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10850 [0101.403] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0101.403] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0101.463] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10850, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x10850, lpOverlapped=0x0) returned 1 [0101.465] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10860, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x10860, lpOverlapped=0x0) returned 1 [0101.467] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.527] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.539] CloseHandle (hObject=0xec) returned 1 [0101.539] CloseHandle (hObject=0xe8) returned 1 [0101.541] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.ozq0")) returned 0 [0101.542] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico.ozq0")) returned 0x20 [0101.542] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="settings.ico", cAlternateFileName="")) returned 0x26fe68 [0101.542] FindNextFileA (in: hFindFile=0x26fe68, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d17f5a, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d17f5a, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c1f3d69, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10850, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="settings.ico", cAlternateFileName="")) returned 0 [0101.542] FindClose (in: hFindFile=0x26fe68 | out: hFindFile=0x26fe68) returned 1 [0101.542] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0 [0101.542] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\settings.ico")) returned 0x20 [0101.542] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="sync.ico", cAlternateFileName="")) returned 1 [0101.543] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0101.543] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0101.543] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc04b [0101.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0101.544] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0101.605] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc04b, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xc04b, lpOverlapped=0x0) returned 1 [0101.607] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xc050, lpOverlapped=0x0) returned 1 [0101.609] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.675] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.686] CloseHandle (hObject=0xe8) returned 1 [0101.686] CloseHandle (hObject=0xec) returned 1 [0101.688] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.ozq0")) returned 0 [0101.688] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico.ozq0")) returned 0x20 [0101.688] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x26fe68, dwReserved1=0x18ee44, cFileName="sync.ico", cAlternateFileName="")) returned 0x26fe60 [0101.688] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d3e0b7, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d3e0b7, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xc04b, dwReserved0=0x26fe68, dwReserved1=0x18ee44, cFileName="sync.ico", cAlternateFileName="")) returned 0 [0101.689] FindClose (in: hFindFile=0x26fe60 | out: hFindFile=0x26fe60) returned 1 [0101.689] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0 [0101.689] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\sync.ico")) returned 0x20 [0101.689] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0101.690] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0101.691] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0101.692] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3473 [0101.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0101.692] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0101.762] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3473, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x3473, lpOverlapped=0x0) returned 1 [0101.764] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x3480, lpOverlapped=0x0) returned 1 [0101.766] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0101.842] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0101.856] CloseHandle (hObject=0xec) returned 1 [0101.856] CloseHandle (hObject=0xe8) returned 1 [0101.857] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.ozq0")) returned 0 [0101.857] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml.ozq0")) returned 0x20 [0101.858] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="tasks.xml", cAlternateFileName="")) returned 0x26fe60 [0101.858] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c219ec7, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0x7c219ec7, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3473, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0101.858] FindClose (in: hFindFile=0x26fe60 | out: hFindFile=0x26fe60) returned 1 [0101.858] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0 [0101.858] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20 [0101.858] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="wmp.ico", cAlternateFileName="")) returned 1 [0101.858] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0101.859] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0101.859] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b9f4 [0101.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0101.859] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0101.930] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1b9f4, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1b9f4, lpOverlapped=0x0) returned 1 [0101.933] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1ba00, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x1ba00, lpOverlapped=0x0) returned 1 [0101.937] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.022] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.037] CloseHandle (hObject=0xe8) returned 1 [0102.037] CloseHandle (hObject=0xec) returned 1 [0102.040] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.ozq0")) returned 0 [0102.040] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico.ozq0")) returned 0x20 [0102.040] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x26fe68, dwReserved1=0x18ee44, cFileName="wmp.ico", cAlternateFileName="")) returned 0x26fe60 [0102.040] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x26fe68, dwReserved1=0x18ee44, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0102.040] FindClose (in: hFindFile=0x26fe60 | out: hFindFile=0x26fe60) returned 1 [0102.041] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0 [0102.041] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\wmp.ico")) returned 0x20 [0102.041] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2d64214, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2d64214, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c219ec7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1b9f4, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="wmp.ico", cAlternateFileName="")) returned 0 [0102.041] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0102.041] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76676f6f, dwReserved1=0x766521e5, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0102.041] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0102.042] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0102.042] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="en-US", cAlternateFileName="")) returned 1 [0102.042] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x26fd98, cFileName=".", cAlternateFileName="")) returned 0x26fe60 [0102.043] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x26fd98, cFileName="..", cAlternateFileName="")) returned 1 [0102.043] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0xbc00ba, dwReserved1=0x26fd98, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0102.043] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0102.044] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0102.045] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e8 [0102.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0102.045] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0102.114] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5e8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x5e8, lpOverlapped=0x0) returned 1 [0102.293] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x5f0, lpOverlapped=0x0) returned 1 [0102.295] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.355] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.367] CloseHandle (hObject=0xe8) returned 1 [0102.367] CloseHandle (hObject=0xf0) returned 1 [0102.368] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.ozq0")) returned 0 [0102.368] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml.ozq0")) returned 0x20 [0102.368] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x270f90, dwReserved1=0x18ebdc, cFileName="resource.xml", cAlternateFileName="")) returned 0x26fd98 [0102.368] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0x270f90, dwReserved1=0x18ebdc, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0102.368] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0102.369] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0 [0102.369] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-US\\resource.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\en-us\\resource.xml")) returned 0x20 [0102.369] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5e8, dwReserved0=0xbc00ba, dwReserved1=0x26fd98, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0102.369] FindClose (in: hFindFile=0x26fe60 | out: hFindFile=0x26fe60) returned 1 [0102.369] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x76f7386c, dwReserved1=0x76653c7d, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0102.369] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0102.369] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0102.370] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a3 [0102.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0102.370] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0102.446] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd0a3, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xd0a3, lpOverlapped=0x0) returned 1 [0102.513] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xd0b0, lpOverlapped=0x0) returned 1 [0102.515] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.574] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.586] CloseHandle (hObject=0xec) returned 1 [0102.586] CloseHandle (hObject=0xf0) returned 1 [0102.588] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ozq0")) returned 0 [0102.588] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico.ozq0")) returned 0x20 [0102.588] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="folder.ico", cAlternateFileName="")) returned 0x26fe68 [0102.588] FindNextFileA (in: hFindFile=0x26fe68, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78a2eab, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0102.588] FindClose (in: hFindFile=0x26fe68 | out: hFindFile=0x26fe68) returned 1 [0102.589] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0 [0102.589] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\folder.ico")) returned 0x20 [0102.589] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="print_pref.ico", cAlternateFileName="")) returned 1 [0102.589] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0102.589] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0102.589] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe3c8 [0102.590] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0102.590] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0102.645] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe3c8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xe3c8, lpOverlapped=0x0) returned 1 [0102.647] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe3d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xe3d0, lpOverlapped=0x0) returned 1 [0102.649] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.712] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.725] CloseHandle (hObject=0xf0) returned 1 [0102.726] CloseHandle (hObject=0xec) returned 1 [0102.727] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.ozq0")) returned 0 [0102.727] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico.ozq0")) returned 0x20 [0102.727] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="print_pref.ico", cAlternateFileName="")) returned 0x26fe70 [0102.728] FindNextFileA (in: hFindFile=0x26fe70, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xe3c8, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="print_pref.ico", cAlternateFileName="")) returned 0 [0102.728] FindClose (in: hFindFile=0x26fe70 | out: hFindFile=0x26fe70) returned 1 [0102.728] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0 [0102.728] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_pref.ico")) returned 0x20 [0102.728] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="print_property.ico", cAlternateFileName="")) returned 1 [0102.728] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0102.728] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0102.729] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xebb8 [0102.729] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0102.729] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0102.799] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xebb8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xebb8, lpOverlapped=0x0) returned 1 [0102.801] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xebc0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xebc0, lpOverlapped=0x0) returned 1 [0102.803] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0102.864] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0102.875] CloseHandle (hObject=0xec) returned 1 [0102.875] CloseHandle (hObject=0xf0) returned 1 [0102.903] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.ozq0")) returned 0 [0102.903] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico.ozq0")) returned 0x20 [0102.903] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="print_property.ico", cAlternateFileName="")) returned 0x26fe78 [0102.903] FindNextFileA (in: hFindFile=0x26fe78, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f0eca86, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f0eca86, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc78c9009, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xebb8, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="print_property.ico", cAlternateFileName="")) returned 0 [0102.903] FindClose (in: hFindFile=0x26fe78 | out: hFindFile=0x26fe78) returned 1 [0102.904] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0 [0102.904] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_property.ico")) returned 0x20 [0102.904] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="print_queue.ico", cAlternateFileName="")) returned 1 [0102.904] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0102.905] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0102.906] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff5 [0102.906] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0102.906] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0102.966] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdff5, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xdff5, lpOverlapped=0x0) returned 1 [0102.968] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe000, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xe000, lpOverlapped=0x0) returned 1 [0102.969] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.034] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.045] CloseHandle (hObject=0xf0) returned 1 [0103.046] CloseHandle (hObject=0xec) returned 1 [0103.048] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.ozq0")) returned 0 [0103.048] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico.ozq0")) returned 0x20 [0103.048] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="print_queue.ico", cAlternateFileName="")) returned 0x26fe70 [0103.048] FindNextFileA (in: hFindFile=0x26fe70, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f112be3, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f112be3, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7be8cbf, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xdff5, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="print_queue.ico", cAlternateFileName="")) returned 0 [0103.048] FindClose (in: hFindFile=0x26fe70 | out: hFindFile=0x26fe70) returned 1 [0103.048] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0 [0103.049] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\print_queue.ico")) returned 0x20 [0103.049] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="scan_.ico", cAlternateFileName="")) returned 1 [0103.049] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0103.049] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.049] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec75 [0103.049] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0103.050] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0103.113] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xec75, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xec75, lpOverlapped=0x0) returned 1 [0103.130] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xec80, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xec80, lpOverlapped=0x0) returned 1 [0103.132] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.200] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.216] CloseHandle (hObject=0xec) returned 1 [0103.216] CloseHandle (hObject=0xf0) returned 1 [0103.218] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.ozq0")) returned 0 [0103.218] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico.ozq0")) returned 0x20 [0103.219] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="scan_.ico", cAlternateFileName="")) returned 0x26fe60 [0103.219] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xec75, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="scan_.ico", cAlternateFileName="")) returned 0 [0103.219] FindClose (in: hFindFile=0x26fe60 | out: hFindFile=0x26fe60) returned 1 [0103.219] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0 [0103.219] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_.ico")) returned 0x20 [0103.219] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="scan_property.ico", cAlternateFileName="")) returned 1 [0103.219] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.220] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0103.220] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10654 [0103.220] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0103.221] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0103.283] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10654, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x10654, lpOverlapped=0x0) returned 1 [0103.330] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10660, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x10660, lpOverlapped=0x0) returned 1 [0103.333] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.406] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.444] CloseHandle (hObject=0xf0) returned 1 [0103.444] CloseHandle (hObject=0xec) returned 1 [0103.447] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.ozq0")) returned 0 [0103.447] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico.ozq0")) returned 0x20 [0103.447] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="scan_property.ico", cAlternateFileName="")) returned 0x26fe70 [0103.447] FindNextFileA (in: hFindFile=0x26fe70, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c0ee1d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x10654, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="scan_property.ico", cAlternateFileName="")) returned 0 [0103.448] FindClose (in: hFindFile=0x26fe70 | out: hFindFile=0x26fe70) returned 1 [0103.448] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0 [0103.448] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_property.ico")) returned 0x20 [0103.448] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="scan_settings.ico", cAlternateFileName="")) returned 1 [0103.448] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0103.448] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.449] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8c2 [0103.449] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0103.449] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0103.509] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf8c2, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xf8c2, lpOverlapped=0x0) returned 1 [0103.545] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf8d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xf8d0, lpOverlapped=0x0) returned 1 [0103.547] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.606] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.618] CloseHandle (hObject=0xec) returned 1 [0103.619] CloseHandle (hObject=0xf0) returned 1 [0103.621] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.ozq0")) returned 0 [0103.622] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico.ozq0")) returned 0x20 [0103.622] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="scan_settings.ico", cAlternateFileName="")) returned 0x26fe70 [0103.622] FindNextFileA (in: hFindFile=0x26fe70, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f138d40, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f138d40, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0xf8c2, dwReserved0=0x26fe80, dwReserved1=0x18ee44, cFileName="scan_settings.ico", cAlternateFileName="")) returned 0 [0103.623] FindClose (in: hFindFile=0x26fe70 | out: hFindFile=0x26fe70) returned 1 [0103.623] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0 [0103.623] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\scan_settings.ico")) returned 0x20 [0103.623] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="tasks.xml", cAlternateFileName="")) returned 1 [0103.623] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0103.624] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0103.625] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c64 [0103.625] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0103.625] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0103.680] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2c64, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2c64, lpOverlapped=0x0) returned 1 [0103.682] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2c70, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2c70, lpOverlapped=0x0) returned 1 [0103.683] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.740] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.752] CloseHandle (hObject=0xf0) returned 1 [0103.752] CloseHandle (hObject=0xec) returned 1 [0103.753] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.ozq0")) returned 0 [0103.753] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml.ozq0")) returned 0x20 [0103.753] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="tasks.xml", cAlternateFileName="")) returned 0x26fe60 [0103.754] FindNextFileA (in: hFindFile=0x26fe60, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0103.754] FindClose (in: hFindFile=0x26fe60 | out: hFindFile=0x26fe60) returned 1 [0103.754] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0 [0103.754] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml")) returned 0x20 [0103.754] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f054512, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f054512, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7d3f90d, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x2c64, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="tasks.xml", cAlternateFileName="")) returned 0 [0103.754] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0103.754] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76676f6f, dwReserved1=0x766521e5, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0103.754] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0103.754] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d646161, dwReserved1=0x34373634, cFileName="Task", cAlternateFileName="")) returned 0 [0103.754] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0103.754] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38653734, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0103.754] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0103.756] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0103.756] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 0 [0103.756] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0103.756] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38653734, cFileName="DRM", cAlternateFileName="")) returned 1 [0103.756] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0103.756] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0103.756] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Server", cAlternateFileName="")) returned 1 [0103.756] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x766f6f63, cFileName=".", cAlternateFileName="")) returned 0x26dd38 [0103.757] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x766f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0103.757] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x766f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0103.757] FindClose (in: hFindFile=0x26dd38 | out: hFindFile=0x26dd38) returned 1 [0103.757] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="Server", cAlternateFileName="")) returned 0 [0103.757] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0103.757] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38653734, cFileName="eHome", cAlternateFileName="")) returned 1 [0103.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0103.757] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0103.757] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="logs", cAlternateFileName="")) returned 1 [0103.757] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x766f6f63, cFileName=".", cAlternateFileName="")) returned 0x26dd38 [0103.758] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x766f6f63, cFileName="..", cAlternateFileName="")) returned 1 [0103.758] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x692e7367, dwReserved1=0x766f6f63, cFileName="..", cAlternateFileName="")) returned 0 [0103.758] FindClose (in: hFindFile=0x26dd38 | out: hFindFile=0x26dd38) returned 1 [0103.758] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="logs", cAlternateFileName="")) returned 0 [0103.758] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0103.758] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d423033, dwReserved1=0x38653734, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0103.758] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0103.759] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="..", cAlternateFileName="")) returned 1 [0103.759] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x2d323437, dwReserved1=0x36396434, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0103.759] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.759] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.763] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d00 [0103.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0103.763] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0103.824] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3d00, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x3d00, lpOverlapped=0x0) returned 1 [0103.827] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3d10, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x3d10, lpOverlapped=0x0) returned 1 [0103.828] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0103.895] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0103.907] CloseHandle (hObject=0xe0) returned 1 [0103.907] CloseHandle (hObject=0xe4) returned 1 [0103.908] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll.ozq0")) returned 0 [0103.909] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll.ozq0")) returned 0x20 [0103.909] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x26dd60, dwReserved1=0x18f314, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0x26dcd8 [0103.909] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x26dd60, dwReserved1=0x18f314, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 0 [0103.909] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0103.909] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll")) returned 1 [0103.911] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlconfig.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlconfig.dll")) returned 0xffffffff [0103.911] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0103.911] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0103.911] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0103.912] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e108 [0103.912] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0103.912] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0103.972] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3e108, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x3e108, lpOverlapped=0x0) returned 1 [0104.057] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3e110, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x3e110, lpOverlapped=0x0) returned 1 [0104.063] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.122] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.134] CloseHandle (hObject=0xe4) returned 1 [0104.134] CloseHandle (hObject=0xe0) returned 1 [0104.138] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll.ozq0")) returned 0 [0104.140] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll.ozq0")) returned 0x20 [0104.140] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x26dcd8, dwReserved1=0x18f314, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0x26dd50 [0104.140] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x26dcd8, dwReserved1=0x18f314, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0104.140] FindClose (in: hFindFile=0x26dd50 | out: hFindFile=0x26dd50) returned 1 [0104.140] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll")) returned 1 [0104.143] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\ppcrlui.dll" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\ppcrlui.dll")) returned 0xffffffff [0104.143] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0104.143] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0104.143] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x38653734, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0104.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0104.144] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0104.144] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 0 [0104.144] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0104.144] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x38653734, cFileName="MF", cAlternateFileName="")) returned 1 [0104.144] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26ccd0 [0104.145] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0104.145] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0104.145] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.145] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.ozq0" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.145] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a7c [0104.146] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0104.146] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0104.230] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x3a7c, lpOverlapped=0x0) returned 1 [0104.445] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x3a80, lpOverlapped=0x0) returned 1 [0104.450] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.509] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.528] CloseHandle (hObject=0xe0) returned 1 [0104.528] CloseHandle (hObject=0xe4) returned 1 [0104.532] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.ozq0" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.ozq0")) returned 0 [0104.533] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL.ozq0" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl.ozq0")) returned 0x2020 [0104.533] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x26dd80, dwReserved1=0x18f314, cFileName="Active.GRL", cAlternateFileName="")) returned 0x26bc38 [0104.533] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x26dd80, dwReserved1=0x18f314, cFileName="Active.GRL", cAlternateFileName="")) returned 0 [0104.533] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0104.533] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl")) returned 1 [0104.535] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\active.grl")) returned 0xffffffff [0104.535] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0104.538] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.539] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.ozq0" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0104.539] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a7c [0104.539] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0104.539] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0104.594] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x3a7c, lpOverlapped=0x0) returned 1 [0104.799] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3a80, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x3a80, lpOverlapped=0x0) returned 1 [0104.802] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0104.873] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0104.885] CloseHandle (hObject=0xe4) returned 1 [0104.885] CloseHandle (hObject=0xe0) returned 1 [0104.888] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.ozq0" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.ozq0")) returned 0 [0104.889] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL.ozq0" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl.ozq0")) returned 0x2020 [0104.889] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x26dd88, dwReserved1=0x18f314, cFileName="Pending.GRL", cAlternateFileName="")) returned 0x26bc38 [0104.889] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x26dd88, dwReserved1=0x18f314, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0104.889] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0104.889] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl")) returned 1 [0104.890] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\users\\all users\\microsoft\\mf\\pending.grl")) returned 0xffffffff [0104.891] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0104.891] FindClose (in: hFindFile=0x26ccd0 | out: hFindFile=0x26ccd0) returned 1 [0104.891] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf410ce90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf410ce90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf410ce90, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c6c642e, dwReserved1=0x38653734, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0104.891] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf410ce90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf410ce90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf410ce90, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0104.891] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf410ce90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf410ce90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf410ce90, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0104.891] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf410ce90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf410ce90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf410ce90, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0104.891] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf410ce90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf410ce90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf410ce90, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName=".", cAlternateFileName="")) returned 0x26dd60 [0104.892] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf410ce90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf410ce90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf410ce90, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="..", cAlternateFileName="")) returned 1 [0104.892] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf410ce90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf410ce90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf410ce90, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="..", cAlternateFileName="")) returned 0 [0104.892] FindClose (in: hFindFile=0x26dd60 | out: hFindFile=0x26dd60) returned 1 [0104.892] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf410ce90, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0xf410ce90, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0xf410ce90, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0104.892] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0104.892] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x38653734, cFileName="Network", cAlternateFileName="")) returned 1 [0104.892] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0104.893] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0104.893] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0104.893] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName=".", cAlternateFileName="")) returned 0x26dd50 [0104.893] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="..", cAlternateFileName="")) returned 1 [0104.893] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="..", cAlternateFileName="")) returned 0 [0104.893] FindClose (in: hFindFile=0x26dd50 | out: hFindFile=0x26dd50) returned 1 [0104.893] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0104.893] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0104.894] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="..", cAlternateFileName="")) returned 1 [0104.894] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xffe39afb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1 [0104.894] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.894] CloseHandle (hObject=0xffffffff) returned 0 [0104.894] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat.ozq0")) returned 0 [0104.894] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat.ozq0")) returned 0xffffffff [0104.894] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xffe39afb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x26ee18, dwReserved1=0x18f0ac, cFileName="qmgr0.dat", cAlternateFileName="")) returned 0x26dcd8 [0104.895] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xffe39afb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x26ee18, dwReserved1=0x18f0ac, cFileName="qmgr0.dat", cAlternateFileName="")) returned 0 [0104.895] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0104.895] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0 [0104.895] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0x120 [0104.895] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xffe85dbc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1 [0104.895] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0104.895] CloseHandle (hObject=0xffffffff) returned 0 [0104.895] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat.ozq0")) returned 0 [0104.895] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat.ozq0")) returned 0xffffffff [0104.895] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xffe85dbc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x26ee18, dwReserved1=0x18f0ac, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0x26dcd8 [0104.895] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xffe85dbc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x26ee18, dwReserved1=0x18f0ac, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0104.896] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0104.896] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat")) returned 0 [0104.896] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\qmgr1.dat")) returned 0x120 [0104.896] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xffe85dbc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0104.896] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0104.899] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0104.900] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0104.900] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab22c10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x1ab22c10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1ab22c10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x38653734, cFileName="Office", cAlternateFileName="")) returned 1 [0104.900] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Office\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab22c10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x1ab22c10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1ab22c10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0104.900] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1ab22c10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x1ab22c10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1ab22c10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0104.900] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab22c10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x1ab22c10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1ab22c10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 1 [0104.900] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab22c10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x1ab22c10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x1ab22c10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="ClickToRunPackageLocker", cAlternateFileName="CLICKT~1")) returned 0 [0104.900] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0104.900] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9152f250, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x183bca20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x183bca20, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616b6361, dwReserved1=0x6f4c6567, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0104.900] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9152f250, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x183bca20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x183bca20, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670061, dwReserved1=0x6c0065, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0104.901] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9152f250, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x183bca20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x183bca20, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670061, dwReserved1=0x6c0065, cFileName="..", cAlternateFileName="")) returned 1 [0104.901] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fd0870, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7a637b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7a637b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x670061, dwReserved1=0x6c0065, cFileName="Cache", cAlternateFileName="")) returned 1 [0104.901] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fd0870, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7a637b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7a637b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName=".", cAlternateFileName="")) returned 0x26dd70 [0104.901] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x92fd0870, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7a637b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xa7a637b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="..", cAlternateFileName="")) returned 1 [0104.901] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a637b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7a637b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x47db9f80, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x16560, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="cache.dat", cAlternateFileName="")) returned 1 [0104.901] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0104.902] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0104.902] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16560 [0104.902] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0104.903] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0104.956] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x16560, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x16560, lpOverlapped=0x0) returned 1 [0104.966] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x16570, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x16570, lpOverlapped=0x0) returned 1 [0104.968] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.033] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.045] CloseHandle (hObject=0xe4) returned 1 [0105.045] CloseHandle (hObject=0xec) returned 1 [0105.048] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat.ozq0")) returned 0 [0105.048] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat.ozq0")) returned 0x2020 [0105.048] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a637b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7a637b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x47db9f80, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x16560, dwReserved0=0x26ee68, dwReserved1=0x18f0ac, cFileName="cache.dat", cAlternateFileName="")) returned 0x26dcd8 [0105.048] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a637b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7a637b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x47db9f80, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x16560, dwReserved0=0x26ee68, dwReserved1=0x18f0ac, cFileName="cache.dat", cAlternateFileName="")) returned 0 [0105.048] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0105.048] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat")) returned 1 [0105.050] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\cache.dat")) returned 0xffffffff [0105.050] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa7a637b0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xa7a637b0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x47db9f80, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x16560, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="cache.dat", cAlternateFileName="")) returned 0 [0105.050] FindClose (in: hFindFile=0x26dd70 | out: hFindFile=0x26dd70) returned 1 [0105.050] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95c26230, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x183bca20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x214ec9a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x2ae74a, dwReserved0=0x670061, dwReserved1=0x6c0065, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0105.050] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0105.051] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0105.051] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ae74a [0105.051] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0105.051] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0105.111] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2ae74a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x2ae74a, lpOverlapped=0x0) returned 1 [0105.216] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2ae750, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x2ae750, lpOverlapped=0x0) returned 1 [0105.276] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.339] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.355] CloseHandle (hObject=0xe0) returned 1 [0105.355] CloseHandle (hObject=0xec) returned 1 [0105.442] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.ozq0")) returned 0 [0105.442] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.ozq0")) returned 0x2020 [0105.442] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95c26230, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x183bca20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x214ec9a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x2ae74a, dwReserved0=0x26dd80, dwReserved1=0x18f314, cFileName="tokens.dat", cAlternateFileName="")) returned 0x26dd78 [0105.443] FindNextFileA (in: hFindFile=0x26dd78, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95c26230, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x183bca20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x214ec9a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x2ae74a, dwReserved0=0x26dd80, dwReserved1=0x18f314, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0105.443] FindClose (in: hFindFile=0x26dd78 | out: hFindFile=0x26dd78) returned 1 [0105.443] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat")) returned 1 [0105.450] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\tokens.dat")) returned 0xffffffff [0105.450] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95c26230, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x183bca20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x214ec9a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x2ae74a, dwReserved0=0x670061, dwReserved1=0x6c0065, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0105.450] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0105.450] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616b6361, dwReserved1=0x6f4c6567, cFileName="RAC", cAlternateFileName="")) returned 1 [0105.450] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0105.450] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0105.450] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Outbound", cAlternateFileName="")) returned 1 [0105.450] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x26dcd8, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0105.451] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x26dcd8, cFileName="..", cAlternateFileName="")) returned 1 [0105.451] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x26dcd8, cFileName="..", cAlternateFileName="")) returned 0 [0105.451] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0105.451] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5018bde0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0105.451] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5018bde0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x26dcd8, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0105.452] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5018bde0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x26dcd8, cFileName="..", cAlternateFileName="")) returned 1 [0105.452] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39034be0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x17126b80, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x920090, dwReserved1=0x26dcd8, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1 [0105.452] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.452] CloseHandle (hObject=0xffffffff) returned 0 [0105.452] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf.ozq0")) returned 0 [0105.452] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf.ozq0")) returned 0xffffffff [0105.452] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39034be0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x17126b80, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ee28, dwReserved1=0x18f0ac, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0x26dcd8 [0105.452] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39034be0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x17126b80, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ee28, dwReserved1=0x18f0ac, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0105.452] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0105.453] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 0 [0105.453] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 0x2020 [0105.453] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x39034be0, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x17126b80, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x920090, dwReserved1=0x26dcd8, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0105.453] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0105.453] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5018bde0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657361, dwReserved1=0x76666473, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0105.453] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5018bde0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0105.453] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5018bde0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5018bde0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0105.453] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38b98140, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x38b98140, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xc7bd67e0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1 [0105.453] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.453] CloseHandle (hObject=0xffffffff) returned 0 [0105.454] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf.ozq0")) returned 0 [0105.454] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf.ozq0")) returned 0xffffffff [0105.454] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38b98140, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x38b98140, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xc7bd67e0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x26ee10, dwReserved1=0x18f0ac, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 0x26dcd8 [0105.454] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x38b98140, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x38b98140, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0xc7bd67e0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x26ee10, dwReserved1=0x18f0ac, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 0 [0105.454] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0105.454] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0 [0105.454] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0x2020 [0105.454] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xc7bd67e0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1 [0105.454] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.454] CloseHandle (hObject=0xffffffff) returned 0 [0105.455] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat.ozq0")) returned 0 [0105.455] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat.ozq0")) returned 0xffffffff [0105.455] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xc7bd67e0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x26ee10, dwReserved1=0x18f0ac, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0x26dcd8 [0105.455] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xc7bd67e0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x26ee10, dwReserved1=0x18f0ac, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0 [0105.455] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0105.455] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat")) returned 0 [0105.455] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\racmetadata.dat")) returned 0x2020 [0105.455] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xc7bd67e0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0 [0105.455] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0105.455] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x54fa6fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x54fa6fc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x76666473, cFileName="Temp", cAlternateFileName="")) returned 1 [0105.455] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x54fa6fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x54fa6fc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName=".", cAlternateFileName="")) returned 0x26dd38 [0105.456] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x54fa6fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x54fa6fc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="..", cAlternateFileName="")) returned 1 [0105.456] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545630e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x545630e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x545fb660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="sql6416.tmp", cAlternateFileName="")) returned 1 [0105.456] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql6416.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql6416.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.456] CloseHandle (hObject=0xffffffff) returned 0 [0105.456] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql6416.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql6416.tmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql6416.tmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql6416.tmp.ozq0")) returned 0 [0105.456] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql6416.tmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql6416.tmp.ozq0")) returned 0xffffffff [0105.456] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql6416.tmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545630e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x545630e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x545fb660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x26edf8, dwReserved1=0x18f0ac, cFileName="sql6416.tmp", cAlternateFileName="")) returned 0x26dcd8 [0105.456] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x545630e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x545630e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x545fb660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x26edf8, dwReserved1=0x18f0ac, cFileName="sql6416.tmp", cAlternateFileName="")) returned 0 [0105.456] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0105.456] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql6416.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql6416.tmp")) returned 0 [0105.456] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql6416.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql6416.tmp")) returned 0x2020 [0105.457] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa6fc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x54fa6fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x550d7ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="sql684C.tmp", cAlternateFileName="")) returned 1 [0105.457] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql684C.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql684c.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0105.457] CloseHandle (hObject=0xffffffff) returned 0 [0105.457] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql684C.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql684c.tmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql684C.tmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql684c.tmp.ozq0")) returned 0 [0105.457] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql684C.tmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql684c.tmp.ozq0")) returned 0xffffffff [0105.457] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql684C.tmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa6fc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x54fa6fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x550d7ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x26edf8, dwReserved1=0x18f0ac, cFileName="sql684C.tmp", cAlternateFileName="")) returned 0x26dcd8 [0105.457] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa6fc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x54fa6fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x550d7ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x26edf8, dwReserved1=0x18f0ac, cFileName="sql684C.tmp", cAlternateFileName="")) returned 0 [0105.457] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0105.457] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql684C.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql684c.tmp")) returned 0 [0105.458] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\sql684C.tmp" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\sql684c.tmp")) returned 0x2020 [0105.458] FindNextFileA (in: hFindFile=0x26dd38, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54fa6fc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x54fa6fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x550d7ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="sql684C.tmp", cAlternateFileName="")) returned 0 [0105.458] FindClose (in: hFindFile=0x26dd38 | out: hFindFile=0x26dd38) returned 1 [0105.458] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x54fa6fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x54fa6fc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x76666473, cFileName="Temp", cAlternateFileName="")) returned 0 [0105.458] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0105.458] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7857c6f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7857c6f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7857c6f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616b6174, dwReserved1=0x6f4c6567, cFileName="Search", cAlternateFileName="")) returned 1 [0105.458] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7857c6f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7857c6f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7857c6f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x76666473, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0105.458] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7857c6f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7857c6f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7857c6f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x76666473, cFileName="..", cAlternateFileName="")) returned 1 [0105.458] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7857c6f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785eeb10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785eeb10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x76666473, cFileName="Data", cAlternateFileName="")) returned 1 [0105.458] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7857c6f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785eeb10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785eeb10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0105.460] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7857c6f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785eeb10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785eeb10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0105.460] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785eeb10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785eeb10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0105.460] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785eeb10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785eeb10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0105.461] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785eeb10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785eeb10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0105.461] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a363b50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a363b50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="Windows", cAlternateFileName="")) returned 1 [0105.461] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a363b50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a363b50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe20 [0105.463] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a363b50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a363b50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0105.463] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78614c70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78614c70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78614c70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="Config", cAlternateFileName="")) returned 1 [0105.463] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Config\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78614c70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78614c70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78614c70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fd90 [0105.463] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78614c70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78614c70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78614c70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0105.463] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78614c70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x78614c70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x78614c70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0105.463] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0105.464] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78614c70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a826750, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="GatherLogs", cAlternateFileName="GATHER~1")) returned 1 [0105.464] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78614c70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a826750, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fd90 [0105.464] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x78614c70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a826750, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0105.464] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a826750, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0105.464] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a826750, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fdd0 [0105.465] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a826750, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0105.465] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d5e21c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 1 [0105.465] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0105.465] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0105.467] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a [0105.467] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0105.468] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0105.555] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13a, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x13a, lpOverlapped=0x0) returned 1 [0105.556] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x140, lpOverlapped=0x0) returned 1 [0105.557] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.618] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.630] CloseHandle (hObject=0xf4) returned 1 [0105.630] CloseHandle (hObject=0xf8) returned 1 [0105.631] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl.ozq0")) returned 0 [0105.632] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl.ozq0")) returned 0x2020 [0105.632] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d5e21c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 0x272f50 [0105.632] FindNextFileA (in: hFindFile=0x272f50, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d5e21c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="SystemIndex.1.Crwl", cAlternateFileName="SYSTEM~1.CRW")) returned 0 [0105.632] FindClose (in: hFindFile=0x272f50 | out: hFindFile=0x272f50) returned 1 [0105.632] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl")) returned 1 [0105.633] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.Crwl" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.crwl")) returned 0xffffffff [0105.633] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d5e21c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 1 [0105.633] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0105.634] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0105.634] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22e [0105.634] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0105.635] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0105.697] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x22e, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x22e, lpOverlapped=0x0) returned 1 [0105.698] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x230, lpOverlapped=0x0) returned 1 [0105.699] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.792] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.804] CloseHandle (hObject=0xf8) returned 1 [0105.805] CloseHandle (hObject=0xf4) returned 1 [0105.806] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr.ozq0")) returned 0 [0105.807] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr.ozq0")) returned 0x2020 [0105.807] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d5e21c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0x272f50 [0105.807] FindNextFileA (in: hFindFile=0x272f50, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d5e21c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0 [0105.807] FindClose (in: hFindFile=0x272f50 | out: hFindFile=0x272f50) returned 1 [0105.807] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr")) returned 1 [0105.818] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\GatherLogs\\SystemIndex\\SystemIndex.1.gthr" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\gatherlogs\\systemindex\\systemindex.1.gthr")) returned 0xffffffff [0105.818] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x8d5e21c0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="SystemIndex.1.gthr", cAlternateFileName="SYSTEM~1.GTH")) returned 0 [0105.819] FindClose (in: hFindFile=0x26fdd0 | out: hFindFile=0x26fdd0) returned 1 [0105.819] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a826750, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a826750, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0105.819] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0105.819] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a33d9f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a33d9f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a363b50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="MSS.chk", cAlternateFileName="")) returned 1 [0105.819] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.820] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0105.825] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0105.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0105.826] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0105.895] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2000, lpOverlapped=0x0) returned 1 [0105.897] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2010, lpOverlapped=0x0) returned 1 [0105.899] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0105.961] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0105.974] CloseHandle (hObject=0xf0) returned 1 [0105.974] CloseHandle (hObject=0xe8) returned 1 [0105.976] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk.ozq0")) returned 0 [0105.976] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk.ozq0")) returned 0x2020 [0105.976] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a33d9f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a33d9f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a363b50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x270f08, dwReserved1=0x18ebdc, cFileName="MSS.chk", cAlternateFileName="")) returned 0x26fd90 [0105.976] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a33d9f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a33d9f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a363b50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x270f08, dwReserved1=0x18ebdc, cFileName="MSS.chk", cAlternateFileName="")) returned 0 [0105.976] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0105.977] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk")) returned 1 [0105.978] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.chk" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.chk")) returned 0xffffffff [0105.978] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a317890, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a317890, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="MSS.log", cAlternateFileName="")) returned 1 [0105.978] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0105.978] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0105.980] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0105.980] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0105.980] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0106.053] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0106.297] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0106.327] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.383] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.398] CloseHandle (hObject=0xe8) returned 1 [0106.398] CloseHandle (hObject=0xf0) returned 1 [0106.420] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log.ozq0")) returned 0 [0106.420] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log.ozq0")) returned 0x2020 [0106.420] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a317890, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a317890, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x270f08, dwReserved1=0x18ebdc, cFileName="MSS.log", cAlternateFileName="")) returned 0x26fd90 [0106.421] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a317890, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a317890, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x270f08, dwReserved1=0x18ebdc, cFileName="MSS.log", cAlternateFileName="")) returned 0 [0106.421] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0106.421] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log")) returned 1 [0106.441] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSS.log" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mss.log")) returned 0xffffffff [0106.442] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a317890, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a317890, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a317890, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 1 [0106.442] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.442] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0106.443] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0106.443] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0106.443] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0106.519] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0106.541] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0106.598] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.689] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.706] CloseHandle (hObject=0xf0) returned 1 [0106.706] CloseHandle (hObject=0xe8) returned 1 [0106.724] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs.ozq0")) returned 0 [0106.725] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs.ozq0")) returned 0x2020 [0106.725] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a317890, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a317890, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a317890, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 0x26fd90 [0106.725] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a317890, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a317890, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a317890, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="MSSres00001.jrs", cAlternateFileName="MSSRES~1.JRS")) returned 0 [0106.725] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0106.726] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs")) returned 1 [0106.739] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00001.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00001.jrs")) returned 0xffffffff [0106.739] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a33d9f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a33d9f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a33d9f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 1 [0106.739] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0106.739] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0106.740] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0106.740] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0106.740] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0106.809] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0106.828] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0106.861] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0106.914] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0106.927] CloseHandle (hObject=0xe8) returned 1 [0106.927] CloseHandle (hObject=0xf0) returned 1 [0106.948] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs.ozq0")) returned 0 [0106.949] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs.ozq0")) returned 0x2020 [0106.949] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a33d9f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a33d9f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a33d9f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 0x26fd90 [0106.949] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a33d9f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a33d9f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a33d9f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="MSSres00002.jrs", cAlternateFileName="MSSRES~2.JRS")) returned 0 [0106.949] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0106.949] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs")) returned 1 [0106.960] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\MSSres00002.jrs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\mssres00002.jrs")) returned 0xffffffff [0106.961] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786ad1f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x786ad1f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Projects", cAlternateFileName="")) returned 1 [0106.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786ad1f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x786ad1f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x270e68, cFileName=".", cAlternateFileName="")) returned 0x26fd90 [0106.961] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786ad1f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x786ad1f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x270e68, cFileName="..", cAlternateFileName="")) returned 1 [0106.961] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x270e68, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 1 [0106.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName=".", cAlternateFileName="")) returned 0x26fdd0 [0106.962] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 1 [0106.962] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="Indexer", cAlternateFileName="")) returned 1 [0106.962] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x272f40 [0106.962] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0106.962] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName="CiFiles", cAlternateFileName="")) returned 1 [0106.962] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\*.*", lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e1cc, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x272e78 [0106.965] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e1cc, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0106.965] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x18e1cc, dwReserved1=0x76f73c74, cFileName="CiAB0001.000", cAlternateFileName="")) returned 1 [0106.965] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0106.966] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0106.966] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0106.966] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0106.967] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0107.047] ReadFile (in: hFile=0xfc, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e1c8*=0xf0, lpOverlapped=0x0) returned 1 [0107.048] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x100, lpOverlapped=0x0) returned 1 [0107.049] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.121] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.136] CloseHandle (hObject=0xfc) returned 1 [0107.136] CloseHandle (hObject=0x100) returned 1 [0107.139] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000.ozq0")) returned 0 [0107.140] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000.ozq0")) returned 0x2020 [0107.140] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0001.000", cAlternateFileName="")) returned 0x272eb8 [0107.141] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0001.000", cAlternateFileName="")) returned 0 [0107.141] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0107.141] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000")) returned 1 [0107.142] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.000")) returned 0xffffffff [0107.143] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="CiAB0001.001", cAlternateFileName="")) returned 1 [0107.143] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0107.144] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.001.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0107.144] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0107.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0107.145] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0107.215] WriteFile (in: hFile=0xfc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10, lpOverlapped=0x0) returned 1 [0107.216] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.273] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.287] CloseHandle (hObject=0x100) returned 1 [0107.287] CloseHandle (hObject=0xfc) returned 1 [0107.289] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.001.ozq0")) returned 0 [0107.289] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.001.ozq0")) returned 0x2020 [0107.291] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0001.001", cAlternateFileName="")) returned 0x272eb8 [0107.291] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0001.001", cAlternateFileName="")) returned 0 [0107.291] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0107.291] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.001")) returned 1 [0107.292] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.001")) returned 0xffffffff [0107.292] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="CiAB0001.002", cAlternateFileName="")) returned 1 [0107.292] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0107.292] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.002.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0107.293] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0107.293] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0107.293] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0107.369] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10, lpOverlapped=0x0) returned 1 [0107.370] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.428] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.443] CloseHandle (hObject=0xfc) returned 1 [0107.444] CloseHandle (hObject=0x100) returned 1 [0107.445] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.002.ozq0")) returned 0 [0107.446] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.002.ozq0")) returned 0x2020 [0107.446] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0001.002", cAlternateFileName="")) returned 0x272eb8 [0107.446] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0001.002", cAlternateFileName="")) returned 0 [0107.446] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0107.446] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.002")) returned 1 [0107.447] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0001.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0001.002")) returned 0xffffffff [0107.452] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="CiAB0002.000", cAlternateFileName="")) returned 1 [0107.452] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0107.453] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0107.453] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0107.454] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0107.454] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0107.547] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e1c8*=0xf0, lpOverlapped=0x0) returned 1 [0107.556] WriteFile (in: hFile=0xfc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x100, lpOverlapped=0x0) returned 1 [0107.558] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.613] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.628] CloseHandle (hObject=0x100) returned 1 [0107.628] CloseHandle (hObject=0xfc) returned 1 [0107.630] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000.ozq0")) returned 0 [0107.631] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000.ozq0")) returned 0x2020 [0107.631] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0002.000", cAlternateFileName="")) returned 0x272eb8 [0107.631] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0002.000", cAlternateFileName="")) returned 0 [0107.631] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0107.631] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000")) returned 1 [0107.634] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.000")) returned 0xffffffff [0107.634] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="CiAB0002.001", cAlternateFileName="")) returned 1 [0107.634] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0107.634] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.001.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0107.635] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0107.635] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0107.635] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0107.705] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10, lpOverlapped=0x0) returned 1 [0107.709] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.767] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.780] CloseHandle (hObject=0xfc) returned 1 [0107.780] CloseHandle (hObject=0x100) returned 1 [0107.809] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.001.ozq0")) returned 0 [0107.810] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.001.ozq0")) returned 0x2020 [0107.810] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0002.001", cAlternateFileName="")) returned 0x272eb8 [0107.810] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0002.001", cAlternateFileName="")) returned 0 [0107.810] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0107.810] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.001")) returned 1 [0107.811] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.001")) returned 0xffffffff [0107.811] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="CiAB0002.002", cAlternateFileName="")) returned 1 [0107.811] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0107.811] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.002.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0107.812] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0107.812] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0107.813] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0107.877] WriteFile (in: hFile=0xfc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10, lpOverlapped=0x0) returned 1 [0107.878] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0107.938] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0107.951] CloseHandle (hObject=0x100) returned 1 [0107.952] CloseHandle (hObject=0xfc) returned 1 [0107.953] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.002.ozq0")) returned 0 [0107.953] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.002.ozq0")) returned 0x2020 [0107.953] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0002.002", cAlternateFileName="")) returned 0x272eb8 [0107.954] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a898b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAB0002.002", cAlternateFileName="")) returned 0 [0107.954] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0107.954] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.002")) returned 1 [0107.954] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAB0002.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciab0002.002")) returned 0xffffffff [0107.955] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="CiAD0001.000", cAlternateFileName="")) returned 1 [0107.955] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0107.955] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0107.955] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0107.956] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0107.956] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0108.019] ReadFile (in: hFile=0xfc, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e1c8*=0xf0, lpOverlapped=0x0) returned 1 [0108.020] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x100, lpOverlapped=0x0) returned 1 [0108.021] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.082] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.097] CloseHandle (hObject=0xfc) returned 1 [0108.097] CloseHandle (hObject=0x100) returned 1 [0108.099] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000.ozq0")) returned 0 [0108.099] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000.ozq0")) returned 0x2020 [0108.099] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAD0001.000", cAlternateFileName="")) returned 0x272eb8 [0108.100] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAD0001.000", cAlternateFileName="")) returned 0 [0108.100] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0108.100] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000")) returned 1 [0108.130] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.000")) returned 0xffffffff [0108.130] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="CiAD0001.001", cAlternateFileName="")) returned 1 [0108.131] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.131] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.001.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0108.131] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0108.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0108.132] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0108.205] WriteFile (in: hFile=0xfc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10, lpOverlapped=0x0) returned 1 [0108.207] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.271] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.287] CloseHandle (hObject=0x100) returned 1 [0108.287] CloseHandle (hObject=0xfc) returned 1 [0108.294] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.001.ozq0")) returned 0 [0108.295] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.001.ozq0")) returned 0x2020 [0108.295] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAD0001.001", cAlternateFileName="")) returned 0x272eb8 [0108.295] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAD0001.001", cAlternateFileName="")) returned 0 [0108.295] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0108.296] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.001")) returned 1 [0108.296] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.001")) returned 0xffffffff [0108.296] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="CiAD0001.002", cAlternateFileName="")) returned 1 [0108.296] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0108.297] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.002.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.297] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0108.297] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0108.298] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0108.369] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10, lpOverlapped=0x0) returned 1 [0108.370] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.438] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.457] CloseHandle (hObject=0xfc) returned 1 [0108.457] CloseHandle (hObject=0x100) returned 1 [0108.459] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.002.ozq0")) returned 0 [0108.459] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.002.ozq0")) returned 0x2020 [0108.459] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAD0001.002", cAlternateFileName="")) returned 0x272eb8 [0108.460] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a872a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a872a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a872a10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="CiAD0001.002", cAlternateFileName="")) returned 0 [0108.460] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0108.460] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.002")) returned 1 [0108.460] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\CiAD0001.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\ciad0001.002")) returned 0xffffffff [0108.460] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="INDEX.000", cAlternateFileName="")) returned 1 [0108.461] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.461] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0108.462] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0108.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0108.462] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0108.541] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e1c8*=0xf0, lpOverlapped=0x0) returned 1 [0108.542] WriteFile (in: hFile=0xfc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x100, lpOverlapped=0x0) returned 1 [0108.543] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.604] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.618] CloseHandle (hObject=0x100) returned 1 [0108.618] CloseHandle (hObject=0xfc) returned 1 [0108.619] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000.ozq0")) returned 0 [0108.620] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000.ozq0")) returned 0x2020 [0108.620] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x275080, dwReserved1=0x18e23c, cFileName="INDEX.000", cAlternateFileName="")) returned 0x272eb8 [0108.620] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x275080, dwReserved1=0x18e23c, cFileName="INDEX.000", cAlternateFileName="")) returned 0 [0108.620] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0108.620] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000")) returned 1 [0108.621] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.000")) returned 0xffffffff [0108.621] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="INDEX.001", cAlternateFileName="")) returned 1 [0108.621] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0108.622] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.622] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0108.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0108.623] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0108.686] ReadFile (in: hFile=0xfc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e1c8*=0x10000, lpOverlapped=0x0) returned 1 [0108.689] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10010, lpOverlapped=0x0) returned 1 [0108.692] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.755] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.772] CloseHandle (hObject=0xfc) returned 1 [0108.772] CloseHandle (hObject=0x100) returned 1 [0108.775] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001.ozq0")) returned 0 [0108.776] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001.ozq0")) returned 0x2020 [0108.776] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x275080, dwReserved1=0x18e23c, cFileName="INDEX.001", cAlternateFileName="")) returned 0x272eb8 [0108.776] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x275080, dwReserved1=0x18e23c, cFileName="INDEX.001", cAlternateFileName="")) returned 0 [0108.776] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0108.776] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001")) returned 1 [0108.778] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.001")) returned 0xffffffff [0108.779] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="INDEX.002", cAlternateFileName="")) returned 1 [0108.779] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.779] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0108.780] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0108.780] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0108.780] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0108.915] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e1c8*=0x10000, lpOverlapped=0x0) returned 1 [0108.920] WriteFile (in: hFile=0xfc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10010, lpOverlapped=0x0) returned 1 [0108.922] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0108.978] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0108.991] CloseHandle (hObject=0x100) returned 1 [0108.991] CloseHandle (hObject=0xfc) returned 1 [0108.993] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002.ozq0")) returned 0 [0108.993] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002.ozq0")) returned 0x2020 [0108.994] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x275080, dwReserved1=0x18e23c, cFileName="INDEX.002", cAlternateFileName="")) returned 0x272eb8 [0108.994] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x275080, dwReserved1=0x18e23c, cFileName="INDEX.002", cAlternateFileName="")) returned 0 [0108.994] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0108.994] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002")) returned 1 [0108.996] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\INDEX.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\index.002")) returned 0xffffffff [0108.996] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 1 [0108.996] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\SETTINGS.DIA" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\settings.dia"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xfc [0108.996] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\SETTINGS.DIA.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\settings.dia.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0108.997] GetFileSize (in: hFile=0xfc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4 [0108.997] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0108.997] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0109.062] ReadFile (in: hFile=0xfc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e1c8*=0x4, lpOverlapped=0x0) returned 1 [0109.063] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18e1c8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e1c8*=0x10, lpOverlapped=0x0) returned 1 [0109.064] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.121] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.136] CloseHandle (hObject=0xfc) returned 1 [0109.137] CloseHandle (hObject=0x100) returned 1 [0109.139] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\SETTINGS.DIA" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\settings.dia"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\SETTINGS.DIA.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\settings.dia.ozq0")) returned 0 [0109.139] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\SETTINGS.DIA.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\settings.dia.ozq0")) returned 0x2020 [0109.139] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\SETTINGS.DIA", lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 0x272eb8 [0109.140] FindNextFileA (in: hFindFile=0x272eb8, lpFindFileData=0x18e0c4 | out: lpFindFileData=0x18e0c4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x275088, dwReserved1=0x18e23c, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 0 [0109.140] FindClose (in: hFindFile=0x272eb8 | out: hFindFile=0x272eb8) returned 1 [0109.140] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\SETTINGS.DIA" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\settings.dia")) returned 1 [0109.141] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\Indexer\\CiFiles\\SETTINGS.DIA" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\indexer\\cifiles\\settings.dia")) returned 0xffffffff [0109.142] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e450 | out: lpFindFileData=0x18e450*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x76f7387a, dwReserved1=0x76653075, cFileName="SETTINGS.DIA", cAlternateFileName="")) returned 0 [0109.142] FindClose (in: hFindFile=0x272e78 | out: hFindFile=0x272e78) returned 1 [0109.142] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a898b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a898b70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName="CiFiles", cAlternateFileName="")) returned 0 [0109.142] FindClose (in: hFindFile=0x272f40 | out: hFindFile=0x272f40) returned 1 [0109.143] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x786d3350, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="PropMap", cAlternateFileName="")) returned 1 [0109.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x786d3350, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e441, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x272f40 [0109.143] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x786d3350, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e441, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0109.143] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786ad1f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x909a8040, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x18e441, dwReserved1=0x76f73c74, cFileName="CiPT0000.000", cAlternateFileName="")) returned 1 [0109.143] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0109.144] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0109.144] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0109.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0109.145] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0109.215] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0xf0, lpOverlapped=0x0) returned 1 [0109.216] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x100, lpOverlapped=0x0) returned 1 [0109.217] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.290] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.303] CloseHandle (hObject=0xf8) returned 1 [0109.303] CloseHandle (hObject=0x100) returned 1 [0109.304] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000.ozq0")) returned 0 [0109.305] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000.ozq0")) returned 0x2020 [0109.305] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786ad1f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x909a8040, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiPT0000.000", cAlternateFileName="")) returned 0x272e78 [0109.305] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786ad1f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x909a8040, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiPT0000.000", cAlternateFileName="")) returned 0 [0109.305] FindClose (in: hFindFile=0x272e78 | out: hFindFile=0x272e78) returned 1 [0109.305] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000")) returned 1 [0109.306] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.000")) returned 0xffffffff [0109.307] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786d3350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7889c3d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="CiPT0000.001", cAlternateFileName="")) returned 1 [0109.307] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0109.307] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0109.310] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0109.310] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0109.310] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0109.371] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x10000, lpOverlapped=0x0) returned 1 [0109.375] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x10010, lpOverlapped=0x0) returned 1 [0109.377] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.438] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.450] CloseHandle (hObject=0x100) returned 1 [0109.451] CloseHandle (hObject=0xf8) returned 1 [0109.453] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001.ozq0")) returned 0 [0109.453] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001.ozq0")) returned 0x2020 [0109.453] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786d3350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7889c3d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiPT0000.001", cAlternateFileName="")) returned 0x272e78 [0109.454] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786d3350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7889c3d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiPT0000.001", cAlternateFileName="")) returned 0 [0109.454] FindClose (in: hFindFile=0x272e78 | out: hFindFile=0x272e78) returned 1 [0109.454] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001")) returned 1 [0109.456] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.001")) returned 0xffffffff [0109.456] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786d3350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7889c3d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="CiPT0000.002", cAlternateFileName="")) returned 1 [0109.456] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0109.456] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0109.457] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0109.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0109.457] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0109.545] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x10000, lpOverlapped=0x0) returned 1 [0109.548] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x10010, lpOverlapped=0x0) returned 1 [0109.551] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.613] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.625] CloseHandle (hObject=0xf8) returned 1 [0109.625] CloseHandle (hObject=0x100) returned 1 [0109.627] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002.ozq0")) returned 0 [0109.627] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002.ozq0")) returned 0x2020 [0109.627] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786d3350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7889c3d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiPT0000.002", cAlternateFileName="")) returned 0x272e78 [0109.628] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786d3350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7889c3d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiPT0000.002", cAlternateFileName="")) returned 0 [0109.628] FindClose (in: hFindFile=0x272e78 | out: hFindFile=0x272e78) returned 1 [0109.628] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002")) returned 1 [0109.629] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\PropMap\\CiPT0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\propmap\\cipt0000.002")) returned 0xffffffff [0109.629] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x786d3350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x786d3350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7889c3d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="CiPT0000.002", cAlternateFileName="")) returned 0 [0109.629] FindClose (in: hFindFile=0x272f40 | out: hFindFile=0x272f40) returned 1 [0109.630] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250032, dwReserved1=0x275fe0, cFileName="SecStore", cAlternateFileName="")) returned 1 [0109.630] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName=".", cAlternateFileName="")) returned 0x272f40 [0109.630] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="..", cAlternateFileName="")) returned 1 [0109.630] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="CiST0000.000", cAlternateFileName="")) returned 1 [0109.630] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0109.631] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0109.631] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf0 [0109.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0109.631] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0109.693] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0xf0, lpOverlapped=0x0) returned 1 [0109.694] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x100, lpOverlapped=0x0) returned 1 [0109.695] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.757] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.770] CloseHandle (hObject=0x100) returned 1 [0109.771] CloseHandle (hObject=0xf8) returned 1 [0109.772] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000.ozq0")) returned 0 [0109.773] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000.ozq0")) returned 0x2020 [0109.773] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiST0000.000", cAlternateFileName="")) returned 0x272e78 [0109.773] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiST0000.000", cAlternateFileName="")) returned 0 [0109.773] FindClose (in: hFindFile=0x272e78 | out: hFindFile=0x272e78) returned 1 [0109.774] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000")) returned 1 [0109.775] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.000" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.000")) returned 0xffffffff [0109.775] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x90805120, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="CiST0000.001", cAlternateFileName="")) returned 1 [0109.775] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0109.775] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0109.779] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0109.779] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0109.779] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0109.843] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x10000, lpOverlapped=0x0) returned 1 [0109.897] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x10010, lpOverlapped=0x0) returned 1 [0109.899] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0109.961] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0109.973] CloseHandle (hObject=0xf8) returned 1 [0109.973] CloseHandle (hObject=0x100) returned 1 [0109.975] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001.ozq0")) returned 0 [0109.976] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001.ozq0")) returned 0x2020 [0109.976] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x90805120, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiST0000.001", cAlternateFileName="")) returned 0x272e78 [0109.976] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x90805120, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiST0000.001", cAlternateFileName="")) returned 0 [0109.976] FindClose (in: hFindFile=0x272e78 | out: hFindFile=0x272e78) returned 1 [0109.976] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001")) returned 1 [0109.978] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.001" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.001")) returned 0xffffffff [0109.978] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x90805120, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="CiST0000.002", cAlternateFileName="")) returned 1 [0109.978] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0109.978] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0109.979] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0109.979] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0109.979] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0110.039] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x10000, lpOverlapped=0x0) returned 1 [0110.045] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x10010, lpOverlapped=0x0) returned 1 [0110.047] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0110.100] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0110.113] CloseHandle (hObject=0x100) returned 1 [0110.113] CloseHandle (hObject=0xf8) returned 1 [0110.115] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002.ozq0")) returned 0 [0110.116] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002.ozq0")) returned 0x2020 [0110.116] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x90805120, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiST0000.002", cAlternateFileName="")) returned 0x272e78 [0110.116] FindNextFileA (in: hFindFile=0x272e78, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x90805120, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x274070, dwReserved1=0x18e4a4, cFileName="CiST0000.002", cAlternateFileName="")) returned 0 [0110.116] FindClose (in: hFindFile=0x272e78 | out: hFindFile=0x272e78) returned 1 [0110.116] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002")) returned 1 [0110.117] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Projects\\SystemIndex\\SecStore\\CiST0000.002" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\projects\\systemindex\\secstore\\cist0000.002")) returned 0xffffffff [0110.118] FindNextFileA (in: hFindFile=0x272f40, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a84c8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x90805120, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="CiST0000.002", cAlternateFileName="")) returned 0 [0110.118] FindClose (in: hFindFile=0x272f40 | out: hFindFile=0x272f40) returned 1 [0110.118] FindNextFileA (in: hFindFile=0x26fdd0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7a826750, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250032, dwReserved1=0x275fe0, cFileName="SecStore", cAlternateFileName="")) returned 0 [0110.118] FindClose (in: hFindFile=0x26fdd0 | out: hFindFile=0x26fdd0) returned 1 [0110.118] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x786ad1f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a84c8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a84c8b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x270e68, cFileName="SystemIndex", cAlternateFileName="SYSTEM~1")) returned 0 [0110.118] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0110.118] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a363b50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a363b50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Windows.edb", cAlternateFileName="")) returned 1 [0110.118] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0110.118] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0110.119] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4810000 [0110.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0110.119] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0110.195] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0110.483] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0110.644] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0110.780] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0110.929] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0111.150] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0111.351] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0111.600] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0111.733] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0111.985] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0112.128] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0112.296] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0112.404] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0112.537] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0112.687] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0112.854] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0112.992] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0113.136] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0113.259] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0113.392] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0113.605] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0113.741] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0113.867] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0114.030] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0114.214] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0114.358] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0114.509] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0114.630] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0114.836] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x210000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x210000, lpOverlapped=0x0) returned 1 [0114.891] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x210010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x210010, lpOverlapped=0x0) returned 1 [0114.968] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0115.022] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0115.049] CloseHandle (hObject=0xf0) returned 1 [0115.050] CloseHandle (hObject=0xe8) returned 1 [0115.669] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb.ozq0")) returned 0 [0115.679] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb.ozq0" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb.ozq0")) returned 0x2020 [0115.679] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a363b50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a363b50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x270f10, dwReserved1=0x18ebdc, cFileName="Windows.edb", cAlternateFileName="")) returned 0x26fd90 [0115.679] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a363b50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a363b50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x270f10, dwReserved1=0x18ebdc, cFileName="Windows.edb", cAlternateFileName="")) returned 0 [0115.679] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0115.680] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 1 [0115.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Windows\\Windows.edb" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\windows\\windows.edb")) returned 0xffffffff [0115.692] FindNextFileA (in: hFindFile=0x26fe20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a363b50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a363b50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x9095bd80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4810000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Windows.edb", cAlternateFileName="")) returned 0 [0115.692] FindClose (in: hFindFile=0x26fe20 | out: hFindFile=0x26fe20) returned 1 [0115.692] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785eeb10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a363b50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a363b50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="Windows", cAlternateFileName="")) returned 0 [0115.692] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0115.692] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785a2850, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785a2850, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785a2850, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Temp", cAlternateFileName="")) returned 1 [0115.692] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785a2850, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785a2850, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x909ce1a0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73726a2e, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0115.693] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785a2850, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785a2850, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x909ce1a0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73726a2e, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0115.693] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785a2850, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785a2850, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x909ce1a0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x73726a2e, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0115.693] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0115.693] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x785a2850, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785a2850, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785a2850, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Temp", cAlternateFileName="")) returned 0 [0115.693] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0115.693] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7857c6f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x785eeb10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x785eeb10, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461642e, dwReserved1=0x76666473, cFileName="Data", cAlternateFileName="")) returned 0 [0115.693] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0115.694] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7a090130, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a090130, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616b6174, dwReserved1=0x6f4c6567, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0115.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7a090130, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a090130, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74616473, dwReserved1=0x76666473, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0115.694] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7a090130, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a090130, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74616473, dwReserved1=0x76666473, cFileName="..", cAlternateFileName="")) returned 1 [0115.694] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74616473, dwReserved1=0x76666473, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0115.694] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd70 [0115.696] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0115.696] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1 [0115.700] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0115.701] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0115.702] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0115.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0115.703] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0115.788] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0115.958] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0115.960] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.025] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.042] CloseHandle (hObject=0xe0) returned 1 [0116.042] CloseHandle (hObject=0xe4) returned 1 [0116.078] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp.ozq0")) returned 0 [0116.078] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp.ozq0")) returned 0x2020 [0116.079] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile10.bmp", cAlternateFileName="")) returned 0x26dcd8 [0116.079] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile10.bmp", cAlternateFileName="")) returned 0 [0116.079] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0116.080] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0 [0116.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0x20 [0116.080] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1 [0116.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.082] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0116.082] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0116.083] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0116.148] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0116.319] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0116.321] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.390] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.403] CloseHandle (hObject=0xe4) returned 1 [0116.403] CloseHandle (hObject=0xe0) returned 1 [0116.404] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp.ozq0")) returned 0 [0116.405] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp.ozq0")) returned 0x2020 [0116.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile11.bmp", cAlternateFileName="")) returned 0x26dcd8 [0116.405] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile11.bmp", cAlternateFileName="")) returned 0 [0116.405] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0116.405] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp")) returned 0 [0116.405] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile11.bmp")) returned 0x20 [0116.406] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1 [0116.406] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.406] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.407] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0116.407] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0116.407] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0116.465] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0116.479] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0116.481] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.546] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.564] CloseHandle (hObject=0xe0) returned 1 [0116.564] CloseHandle (hObject=0xe4) returned 1 [0116.723] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp.ozq0")) returned 0 [0116.723] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp.ozq0")) returned 0x2020 [0116.723] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile12.bmp", cAlternateFileName="")) returned 0x26dcd8 [0116.724] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile12.bmp", cAlternateFileName="")) returned 0 [0116.724] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0116.724] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp")) returned 0 [0116.724] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile12.bmp")) returned 0x20 [0116.724] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1 [0116.724] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.725] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.725] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbeb8 [0116.725] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0116.726] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0116.831] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xbeb8, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xbeb8, lpOverlapped=0x0) returned 1 [0116.835] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xbec0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xbec0, lpOverlapped=0x0) returned 1 [0116.840] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0116.902] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0116.913] CloseHandle (hObject=0xe4) returned 1 [0116.914] CloseHandle (hObject=0xe0) returned 1 [0116.924] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp.ozq0")) returned 0 [0116.925] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp.ozq0")) returned 0x2020 [0116.925] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile13.bmp", cAlternateFileName="")) returned 0x26dcd8 [0116.926] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile13.bmp", cAlternateFileName="")) returned 0 [0116.926] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0116.926] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp")) returned 0 [0116.926] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile13.bmp")) returned 0x20 [0116.926] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1 [0116.926] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0116.928] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0116.928] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0116.928] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0116.929] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0116.990] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0116.994] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0116.995] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.047] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.070] CloseHandle (hObject=0xe0) returned 1 [0117.070] CloseHandle (hObject=0xe4) returned 1 [0117.142] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp.ozq0")) returned 0 [0117.143] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp.ozq0")) returned 0x2020 [0117.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile14.bmp", cAlternateFileName="")) returned 0x26dcd8 [0117.143] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile14.bmp", cAlternateFileName="")) returned 0 [0117.143] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0117.143] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp")) returned 0 [0117.144] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile14.bmp")) returned 0x20 [0117.144] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1 [0117.144] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.144] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.145] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0117.145] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0117.145] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0117.214] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0117.264] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0117.266] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.329] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.345] CloseHandle (hObject=0xe4) returned 1 [0117.346] CloseHandle (hObject=0xe0) returned 1 [0117.690] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp.ozq0")) returned 0 [0117.691] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp.ozq0")) returned 0x2020 [0117.691] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile15.bmp", cAlternateFileName="")) returned 0x26dcd8 [0117.691] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile15.bmp", cAlternateFileName="")) returned 0 [0117.692] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0117.692] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp")) returned 0 [0117.692] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile15.bmp")) returned 0x20 [0117.693] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1 [0117.693] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.693] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.694] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0117.694] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0117.695] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0117.765] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0117.770] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0117.772] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0117.830] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0117.844] CloseHandle (hObject=0xe0) returned 1 [0117.844] CloseHandle (hObject=0xe4) returned 1 [0117.907] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp.ozq0")) returned 0 [0117.907] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp.ozq0")) returned 0x2020 [0117.907] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile16.bmp", cAlternateFileName="")) returned 0x26dcd8 [0117.907] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile16.bmp", cAlternateFileName="")) returned 0 [0117.907] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0117.908] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp")) returned 0 [0117.908] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile16.bmp")) returned 0x20 [0117.908] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1 [0117.908] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0117.909] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0117.910] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0117.910] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0117.910] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0117.979] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0117.999] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0118.001] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.063] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.078] CloseHandle (hObject=0xe4) returned 1 [0118.078] CloseHandle (hObject=0xe0) returned 1 [0118.080] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp.ozq0")) returned 0 [0118.080] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp.ozq0")) returned 0x2020 [0118.081] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile17.bmp", cAlternateFileName="")) returned 0x26dcd8 [0118.081] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile17.bmp", cAlternateFileName="")) returned 0 [0118.081] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0118.081] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp")) returned 0 [0118.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile17.bmp")) returned 0x20 [0118.081] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1 [0118.082] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.083] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.085] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0118.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0118.086] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0118.171] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0118.340] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0118.343] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.410] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.423] CloseHandle (hObject=0xe0) returned 1 [0118.423] CloseHandle (hObject=0xe4) returned 1 [0118.427] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp.ozq0")) returned 0 [0118.428] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp.ozq0")) returned 0x2020 [0118.428] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile18.bmp", cAlternateFileName="")) returned 0x26dcd8 [0118.429] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile18.bmp", cAlternateFileName="")) returned 0 [0118.429] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0118.429] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp")) returned 0 [0118.429] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile18.bmp")) returned 0x20 [0118.429] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1 [0118.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.431] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0118.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0118.432] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0118.535] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0118.537] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0118.539] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.604] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.620] CloseHandle (hObject=0xe4) returned 1 [0118.620] CloseHandle (hObject=0xe0) returned 1 [0118.650] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp.ozq0")) returned 0 [0118.650] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp.ozq0")) returned 0x2020 [0118.650] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile19.bmp", cAlternateFileName="")) returned 0x26dcd8 [0118.651] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile19.bmp", cAlternateFileName="")) returned 0 [0118.651] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0118.651] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp")) returned 0 [0118.651] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile19.bmp")) returned 0x20 [0118.651] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1 [0118.651] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.652] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.652] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0118.652] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0118.653] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0118.725] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0118.739] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0118.743] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0118.810] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0118.824] CloseHandle (hObject=0xe0) returned 1 [0118.825] CloseHandle (hObject=0xe4) returned 1 [0118.863] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp.ozq0")) returned 0 [0118.864] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp.ozq0")) returned 0x2020 [0118.864] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile20.bmp", cAlternateFileName="")) returned 0x26dcd8 [0118.864] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile20.bmp", cAlternateFileName="")) returned 0 [0118.864] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0118.865] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp")) returned 0 [0118.865] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile20.bmp")) returned 0x20 [0118.865] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1 [0118.866] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0118.867] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0118.868] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0118.868] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0118.868] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0118.941] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0118.944] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0118.947] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.005] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.019] CloseHandle (hObject=0xe4) returned 1 [0119.019] CloseHandle (hObject=0xe0) returned 1 [0119.023] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp.ozq0")) returned 0 [0119.023] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp.ozq0")) returned 0x2020 [0119.023] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile21.bmp", cAlternateFileName="")) returned 0x26dcd8 [0119.024] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile21.bmp", cAlternateFileName="")) returned 0 [0119.024] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0119.024] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp")) returned 0 [0119.024] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile21.bmp")) returned 0x20 [0119.024] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1 [0119.024] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.025] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.027] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0119.027] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0119.027] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0119.098] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0119.100] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0119.102] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.168] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.185] CloseHandle (hObject=0xe0) returned 1 [0119.185] CloseHandle (hObject=0xe4) returned 1 [0119.187] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp.ozq0")) returned 0 [0119.187] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp.ozq0")) returned 0x2020 [0119.188] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile22.bmp", cAlternateFileName="")) returned 0x26dcd8 [0119.188] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile22.bmp", cAlternateFileName="")) returned 0 [0119.188] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0119.188] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp")) returned 0 [0119.188] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile22.bmp")) returned 0x20 [0119.189] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1 [0119.189] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.189] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.190] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0119.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0119.190] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0119.270] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0119.273] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0119.276] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.337] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.353] CloseHandle (hObject=0xe4) returned 1 [0119.353] CloseHandle (hObject=0xe0) returned 1 [0119.358] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp.ozq0")) returned 0 [0119.358] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp.ozq0")) returned 0x2020 [0119.358] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile23.bmp", cAlternateFileName="")) returned 0x26dcd8 [0119.358] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile23.bmp", cAlternateFileName="")) returned 0 [0119.358] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0119.359] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp")) returned 0 [0119.359] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile23.bmp")) returned 0x20 [0119.359] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1 [0119.359] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.359] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.360] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0119.360] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0119.360] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0119.431] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0119.435] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0119.437] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.494] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.511] CloseHandle (hObject=0xe0) returned 1 [0119.511] CloseHandle (hObject=0xe4) returned 1 [0119.516] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp.ozq0")) returned 0 [0119.516] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp.ozq0")) returned 0x2020 [0119.516] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile24.bmp", cAlternateFileName="")) returned 0x26dcd8 [0119.517] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile24.bmp", cAlternateFileName="")) returned 0 [0119.517] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0119.517] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp")) returned 0 [0119.517] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile24.bmp")) returned 0x20 [0119.517] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1 [0119.517] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.517] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.518] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0119.518] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0119.518] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0119.583] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0119.585] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0119.587] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.658] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.673] CloseHandle (hObject=0xe4) returned 1 [0119.673] CloseHandle (hObject=0xe0) returned 1 [0119.685] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp.ozq0")) returned 0 [0119.686] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp.ozq0")) returned 0x2020 [0119.686] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile25.bmp", cAlternateFileName="")) returned 0x26dcd8 [0119.686] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile25.bmp", cAlternateFileName="")) returned 0 [0119.686] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0119.686] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp")) returned 0 [0119.687] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile25.bmp")) returned 0x20 [0119.687] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1 [0119.687] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.689] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.689] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0119.689] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0119.690] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0119.759] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0119.775] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0119.777] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0119.842] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0119.855] CloseHandle (hObject=0xe0) returned 1 [0119.856] CloseHandle (hObject=0xe4) returned 1 [0119.874] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp.ozq0")) returned 0 [0119.874] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp.ozq0")) returned 0x2020 [0119.874] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile26.bmp", cAlternateFileName="")) returned 0x26dcd8 [0119.875] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile26.bmp", cAlternateFileName="")) returned 0 [0119.875] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0119.875] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp")) returned 0 [0119.875] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile26.bmp")) returned 0x20 [0119.875] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1 [0119.875] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0119.876] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0119.876] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0119.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0119.876] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0119.947] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0119.949] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0119.951] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.010] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.026] CloseHandle (hObject=0xe4) returned 1 [0120.026] CloseHandle (hObject=0xe0) returned 1 [0120.028] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp.ozq0")) returned 0 [0120.028] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp.ozq0")) returned 0x2020 [0120.028] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile27.bmp", cAlternateFileName="")) returned 0x26dcd8 [0120.029] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile27.bmp", cAlternateFileName="")) returned 0 [0120.029] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0120.029] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp")) returned 0 [0120.029] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile27.bmp")) returned 0x20 [0120.029] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1 [0120.029] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.030] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.030] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0120.030] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0120.031] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0120.106] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0120.112] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0120.115] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.180] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.213] CloseHandle (hObject=0xe0) returned 1 [0120.214] CloseHandle (hObject=0xe4) returned 1 [0120.215] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp.ozq0")) returned 0 [0120.215] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp.ozq0")) returned 0x2020 [0120.216] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile28.bmp", cAlternateFileName="")) returned 0x26dcd8 [0120.216] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile28.bmp", cAlternateFileName="")) returned 0 [0120.216] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0120.216] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp")) returned 0 [0120.216] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile28.bmp")) returned 0x20 [0120.216] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1 [0120.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.217] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.217] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0120.218] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0120.218] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0120.293] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0120.297] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0120.299] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.390] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.404] CloseHandle (hObject=0xe4) returned 1 [0120.404] CloseHandle (hObject=0xe0) returned 1 [0120.405] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp.ozq0")) returned 0 [0120.405] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp.ozq0")) returned 0x2020 [0120.406] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile29.bmp", cAlternateFileName="")) returned 0x26dcd8 [0120.406] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile29.bmp", cAlternateFileName="")) returned 0 [0120.406] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0120.406] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp")) returned 0 [0120.407] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile29.bmp")) returned 0x20 [0120.407] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1 [0120.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.408] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0120.408] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0120.408] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0120.477] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0120.481] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0120.483] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.544] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.557] CloseHandle (hObject=0xe0) returned 1 [0120.557] CloseHandle (hObject=0xe4) returned 1 [0120.559] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp.ozq0")) returned 0 [0120.560] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp.ozq0")) returned 0x2020 [0120.560] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile30.bmp", cAlternateFileName="")) returned 0x26dcd8 [0120.560] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile30.bmp", cAlternateFileName="")) returned 0 [0120.560] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0120.560] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp")) returned 0 [0120.560] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile30.bmp")) returned 0x20 [0120.560] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1 [0120.560] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.561] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.561] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0120.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0120.562] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0120.637] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0120.639] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0120.642] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.703] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.738] CloseHandle (hObject=0xe4) returned 1 [0120.738] CloseHandle (hObject=0xe0) returned 1 [0120.741] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp.ozq0")) returned 0 [0120.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp.ozq0")) returned 0x2020 [0120.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile31.bmp", cAlternateFileName="")) returned 0x26dcd8 [0120.741] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile31.bmp", cAlternateFileName="")) returned 0 [0120.741] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0120.742] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp")) returned 0 [0120.742] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile31.bmp")) returned 0x20 [0120.742] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1 [0120.742] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.742] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.743] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0120.743] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0120.743] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0120.820] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0120.823] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0120.825] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0120.896] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0120.910] CloseHandle (hObject=0xe0) returned 1 [0120.910] CloseHandle (hObject=0xe4) returned 1 [0120.912] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp.ozq0")) returned 0 [0120.912] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp.ozq0")) returned 0x2020 [0120.912] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile32.bmp", cAlternateFileName="")) returned 0x26dcd8 [0120.913] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile32.bmp", cAlternateFileName="")) returned 0 [0120.913] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0120.913] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp")) returned 0 [0120.913] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile32.bmp")) returned 0x20 [0120.913] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1 [0120.913] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0120.914] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0120.914] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0120.914] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0120.915] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0120.981] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0120.983] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0120.985] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.042] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.055] CloseHandle (hObject=0xe4) returned 1 [0121.056] CloseHandle (hObject=0xe0) returned 1 [0121.058] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp.ozq0")) returned 0 [0121.059] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp.ozq0")) returned 0x2020 [0121.059] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile33.bmp", cAlternateFileName="")) returned 0x26dcd8 [0121.059] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile33.bmp", cAlternateFileName="")) returned 0 [0121.059] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0121.059] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp")) returned 0 [0121.059] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile33.bmp")) returned 0x20 [0121.060] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1 [0121.060] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0121.060] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.061] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0121.061] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0121.061] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0121.122] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0121.124] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0121.126] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.183] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.197] CloseHandle (hObject=0xe0) returned 1 [0121.197] CloseHandle (hObject=0xe4) returned 1 [0121.199] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp.ozq0")) returned 0 [0121.199] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp.ozq0")) returned 0x2020 [0121.199] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile34.bmp", cAlternateFileName="")) returned 0x26dcd8 [0121.199] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile34.bmp", cAlternateFileName="")) returned 0 [0121.199] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0121.200] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp")) returned 0 [0121.200] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile34.bmp")) returned 0x20 [0121.200] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1 [0121.200] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.200] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0121.201] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0121.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0121.201] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0121.263] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0121.265] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0121.267] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.325] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.338] CloseHandle (hObject=0xe4) returned 1 [0121.339] CloseHandle (hObject=0xe0) returned 1 [0121.343] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp.ozq0")) returned 0 [0121.343] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp.ozq0")) returned 0x2020 [0121.343] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile35.bmp", cAlternateFileName="")) returned 0x26dcd8 [0121.343] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile35.bmp", cAlternateFileName="")) returned 0 [0121.343] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0121.344] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp")) returned 0 [0121.344] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile35.bmp")) returned 0x20 [0121.344] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1 [0121.344] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0121.345] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.346] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0121.346] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0121.347] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0121.410] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0121.414] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0121.416] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.478] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.494] CloseHandle (hObject=0xe0) returned 1 [0121.495] CloseHandle (hObject=0xe4) returned 1 [0121.497] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp.ozq0")) returned 0 [0121.498] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp.ozq0")) returned 0x2020 [0121.498] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile36.bmp", cAlternateFileName="")) returned 0x26dcd8 [0121.498] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile36.bmp", cAlternateFileName="")) returned 0 [0121.498] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0121.498] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp")) returned 0 [0121.499] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp")) returned 0x20 [0121.499] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1 [0121.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.499] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0121.500] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0121.500] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0121.500] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0121.575] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0121.579] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0121.582] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.644] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.662] CloseHandle (hObject=0xe4) returned 1 [0121.662] CloseHandle (hObject=0xe0) returned 1 [0121.664] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp.ozq0")) returned 0 [0121.664] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp.ozq0")) returned 0x2020 [0121.664] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile37.bmp", cAlternateFileName="")) returned 0x26dcd8 [0121.665] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile37.bmp", cAlternateFileName="")) returned 0 [0121.665] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0121.665] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp")) returned 0 [0121.665] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile37.bmp")) returned 0x20 [0121.665] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1 [0121.665] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0121.666] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.666] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0121.666] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0121.667] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0121.737] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0121.740] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0121.742] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.807] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0121.830] CloseHandle (hObject=0xe0) returned 1 [0121.830] CloseHandle (hObject=0xe4) returned 1 [0121.832] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp.ozq0")) returned 0 [0121.832] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp.ozq0")) returned 0x2020 [0121.832] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile38.bmp", cAlternateFileName="")) returned 0x26dcd8 [0121.832] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile38.bmp", cAlternateFileName="")) returned 0 [0121.833] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0121.833] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp")) returned 0 [0121.833] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp")) returned 0x20 [0121.833] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1 [0121.833] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0121.833] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0121.835] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0121.835] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0121.835] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0121.920] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0121.924] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0121.926] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0121.990] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.003] CloseHandle (hObject=0xe4) returned 1 [0122.003] CloseHandle (hObject=0xe0) returned 1 [0122.005] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp.ozq0")) returned 0 [0122.005] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp.ozq0")) returned 0x2020 [0122.005] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile39.bmp", cAlternateFileName="")) returned 0x26dcd8 [0122.005] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile39.bmp", cAlternateFileName="")) returned 0 [0122.006] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0122.006] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp")) returned 0 [0122.006] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp")) returned 0x20 [0122.006] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1 [0122.006] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0122.006] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.008] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0122.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0122.009] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0122.059] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0122.062] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0122.064] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.127] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.139] CloseHandle (hObject=0xe0) returned 1 [0122.139] CloseHandle (hObject=0xe4) returned 1 [0122.143] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp.ozq0")) returned 0 [0122.143] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp.ozq0")) returned 0x2020 [0122.143] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile40.bmp", cAlternateFileName="")) returned 0x26dcd8 [0122.144] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile40.bmp", cAlternateFileName="")) returned 0 [0122.144] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0122.144] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp")) returned 0 [0122.144] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp")) returned 0x20 [0122.144] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1 [0122.145] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.145] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0122.146] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0122.146] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0122.146] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0122.207] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0122.211] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0122.214] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.275] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.290] CloseHandle (hObject=0xe4) returned 1 [0122.290] CloseHandle (hObject=0xe0) returned 1 [0122.293] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp.ozq0")) returned 0 [0122.293] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp.ozq0")) returned 0x2020 [0122.294] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile41.bmp", cAlternateFileName="")) returned 0x26dcd8 [0122.294] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile41.bmp", cAlternateFileName="")) returned 0 [0122.294] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0122.294] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp")) returned 0 [0122.295] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp")) returned 0x20 [0122.295] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1 [0122.295] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0122.295] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.296] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0122.296] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0122.296] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0122.361] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0122.364] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0122.366] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.424] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.439] CloseHandle (hObject=0xe0) returned 1 [0122.439] CloseHandle (hObject=0xe4) returned 1 [0122.441] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp.ozq0")) returned 0 [0122.441] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp.ozq0")) returned 0x2020 [0122.441] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile42.bmp", cAlternateFileName="")) returned 0x26dcd8 [0122.442] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile42.bmp", cAlternateFileName="")) returned 0 [0122.442] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0122.442] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp")) returned 0 [0122.442] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp")) returned 0x20 [0122.442] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1 [0122.442] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.443] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0122.443] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0122.443] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0122.443] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0122.548] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0122.551] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0122.553] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.617] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.639] CloseHandle (hObject=0xe4) returned 1 [0122.639] CloseHandle (hObject=0xe0) returned 1 [0122.641] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp.ozq0")) returned 0 [0122.642] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp.ozq0")) returned 0x2020 [0122.642] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile43.bmp", cAlternateFileName="")) returned 0x26dcd8 [0122.642] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile43.bmp", cAlternateFileName="")) returned 0 [0122.642] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0122.642] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp")) returned 0 [0122.642] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp")) returned 0x20 [0122.643] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1 [0122.643] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0122.643] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.644] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0122.644] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0122.644] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0122.701] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc038, lpOverlapped=0x0) returned 1 [0122.704] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc040, lpOverlapped=0x0) returned 1 [0122.706] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.767] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.787] CloseHandle (hObject=0xe0) returned 1 [0122.788] CloseHandle (hObject=0xe4) returned 1 [0122.790] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp.ozq0")) returned 0 [0122.790] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp.ozq0")) returned 0x2020 [0122.790] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0x26dcd8 [0122.790] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26ee70, dwReserved1=0x18f0ac, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0 [0122.790] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0122.791] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp")) returned 0 [0122.791] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile44.bmp")) returned 0x20 [0122.791] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0 [0122.791] FindClose (in: hFindFile=0x26dd70 | out: hFindFile=0x26dd70) returned 1 [0122.791] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x74706d62, dwReserved1=0x76666473, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0122.791] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0122.792] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.792] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0122.792] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0122.793] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0122.856] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xc038, lpOverlapped=0x0) returned 1 [0122.859] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xc040, lpOverlapped=0x0) returned 1 [0122.862] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0122.938] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0122.951] CloseHandle (hObject=0xec) returned 1 [0122.951] CloseHandle (hObject=0xe4) returned 1 [0122.953] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.ozq0")) returned 0 [0122.954] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp.ozq0")) returned 0x2020 [0122.954] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26dd68, dwReserved1=0x18f314, cFileName="guest.bmp", cAlternateFileName="")) returned 0x26dd60 [0122.971] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26dd68, dwReserved1=0x18f314, cFileName="guest.bmp", cAlternateFileName="")) returned 0 [0122.971] FindClose (in: hFindFile=0x26dd60 | out: hFindFile=0x26dd60) returned 1 [0122.971] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp")) returned 1 [0122.973] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\guest.bmp")) returned 0xffffffff [0122.973] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a090130, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a090130, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a090130, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="kEecfMwgj.dat", cAlternateFileName="KEECFM~1.DAT")) returned 1 [0122.973] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\kEecfMwgj.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\keecfmwgj.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0122.974] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\kEecfMwgj.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\keecfmwgj.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0122.974] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0122.974] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0122.975] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0123.035] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x10, lpOverlapped=0x0) returned 1 [0123.036] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.105] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.121] CloseHandle (hObject=0xe4) returned 1 [0123.122] CloseHandle (hObject=0xec) returned 1 [0123.123] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\kEecfMwgj.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\keecfmwgj.dat"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\kEecfMwgj.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\keecfmwgj.dat.ozq0")) returned 0 [0123.124] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\kEecfMwgj.dat.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\keecfmwgj.dat.ozq0")) returned 0x2020 [0123.124] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\kEecfMwgj.dat", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a090130, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a090130, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a090130, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26dd70, dwReserved1=0x18f314, cFileName="kEecfMwgj.dat", cAlternateFileName="KEECFM~1.DAT")) returned 0x26dd68 [0123.124] FindNextFileA (in: hFindFile=0x26dd68, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a090130, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7a090130, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7a090130, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26dd70, dwReserved1=0x18f314, cFileName="kEecfMwgj.dat", cAlternateFileName="KEECFM~1.DAT")) returned 0 [0123.124] FindClose (in: hFindFile=0x26dd68 | out: hFindFile=0x26dd68) returned 1 [0123.124] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\kEecfMwgj.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\keecfmwgj.dat")) returned 1 [0123.125] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\kEecfMwgj.dat" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\keecfmwgj.dat")) returned 0xffffffff [0123.125] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0123.125] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0123.125] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0123.126] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc038 [0123.126] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0123.127] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0123.187] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xc038, lpOverlapped=0x0) returned 1 [0123.189] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc040, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xc040, lpOverlapped=0x0) returned 1 [0123.191] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.253] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.268] CloseHandle (hObject=0xec) returned 1 [0123.268] CloseHandle (hObject=0xe4) returned 1 [0123.271] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.ozq0")) returned 0 [0123.271] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp.ozq0" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp.ozq0")) returned 0x2020 [0123.271] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26dd68, dwReserved1=0x18f314, cFileName="user.bmp", cAlternateFileName="")) returned 0x26dcd8 [0123.272] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x26dd68, dwReserved1=0x18f314, cFileName="user.bmp", cAlternateFileName="")) returned 0 [0123.272] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0123.272] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp")) returned 1 [0123.273] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\user.bmp")) returned 0xffffffff [0123.273] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="user.bmp", cAlternateFileName="")) returned 0 [0123.273] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0123.274] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65727461, dwReserved1=0x6f4c6573, cFileName="Vault", cAlternateFileName="")) returned 1 [0123.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0123.274] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="..", cAlternateFileName="")) returned 1 [0123.274] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="..", cAlternateFileName="")) returned 0 [0123.274] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0123.274] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65727461, dwReserved1=0x6f4c6573, cFileName="Windows", cAlternateFileName="")) returned 1 [0123.274] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0123.275] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="..", cAlternateFileName="")) returned 1 [0123.275] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="AIT", cAlternateFileName="")) returned 1 [0123.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0123.275] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName="..", cAlternateFileName="")) returned 1 [0123.275] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName="..", cAlternateFileName="")) returned 0 [0123.275] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0123.276] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="Caches", cAlternateFileName="")) returned 1 [0123.276] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0123.276] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName="..", cAlternateFileName="")) returned 1 [0123.276] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0123.276] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0123.276] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0123.277] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0123.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0123.278] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0123.336] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x4000, lpOverlapped=0x0) returned 1 [0123.338] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x4010, lpOverlapped=0x0) returned 1 [0123.339] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.404] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.420] CloseHandle (hObject=0xec) returned 1 [0123.420] CloseHandle (hObject=0xe0) returned 1 [0123.422] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.ozq0")) returned 0 [0123.422] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db.ozq0")) returned 0x2020 [0123.422] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26ee10, dwReserved1=0x18f0ac, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 0x26dcd8 [0123.423] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26ee10, dwReserved1=0x18f0ac, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 0 [0123.423] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0123.423] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db")) returned 0 [0123.423] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\cversions.2.db")) returned 0x2020 [0123.423] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd595a0b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd595a0b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd595a0b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db", cAlternateFileName="{22838~1.DB")) returned 1 [0123.423] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0123.423] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0123.424] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c0 [0123.424] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0123.424] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0123.481] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x4c0, lpOverlapped=0x0) returned 1 [0123.482] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x4d0, lpOverlapped=0x0) returned 1 [0123.485] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.541] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.556] CloseHandle (hObject=0xe0) returned 1 [0123.556] CloseHandle (hObject=0xec) returned 1 [0123.559] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db.ozq0")) returned 0 [0123.559] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db.ozq0")) returned 0x2020 [0123.560] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd595a0b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd595a0b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd595a0b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db", cAlternateFileName="{22838~1.DB")) returned 0x26dcd8 [0123.560] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd595a0b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd595a0b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd595a0b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db", cAlternateFileName="{22838~1.DB")) returned 0 [0123.560] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0123.560] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db")) returned 0 [0123.560] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{228385D3-B646-481B-B0DE-F0C3A58F5423}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{228385d3-b646-481b-b0de-f0c3a58f5423}.2.ver0x0000000000000001.db")) returned 0x2020 [0123.560] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd613c990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db", cAlternateFileName="{2F368~1.DB")) returned 1 [0123.561] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0123.561] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0123.561] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x418 [0123.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0123.562] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0123.618] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x418, lpOverlapped=0x0) returned 1 [0123.619] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x420, lpOverlapped=0x0) returned 1 [0123.621] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.677] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.692] CloseHandle (hObject=0xec) returned 1 [0123.692] CloseHandle (hObject=0xe0) returned 1 [0123.696] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db.ozq0")) returned 0 [0123.696] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db.ozq0")) returned 0x2020 [0123.697] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd613c990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db", cAlternateFileName="{2F368~1.DB")) returned 0x26dcd8 [0123.697] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd613c990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db", cAlternateFileName="{2F368~1.DB")) returned 0 [0123.697] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0123.697] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db")) returned 0 [0123.697] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{2F368D22-02BF-4413-97D1-C886CB140911}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{2f368d22-02bf-4413-97d1-c886cb140911}.2.ver0x0000000000000001.db")) returned 0x2020 [0123.698] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf67691e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf67691e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf67691e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", cAlternateFileName="{40FC8~1.DB")) returned 1 [0123.698] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0123.698] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0123.701] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x908 [0123.701] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0123.701] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0123.762] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x908, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x908, lpOverlapped=0x0) returned 1 [0123.763] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x910, lpOverlapped=0x0) returned 1 [0123.764] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.819] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.833] CloseHandle (hObject=0xe0) returned 1 [0123.833] CloseHandle (hObject=0xec) returned 1 [0123.835] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db.ozq0")) returned 0 [0123.835] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db.ozq0")) returned 0x2020 [0123.836] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf67691e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf67691e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf67691e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", cAlternateFileName="{40FC8~1.DB")) returned 0x26dcd8 [0123.836] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf67691e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf67691e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf67691e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db", cAlternateFileName="{40FC8~1.DB")) returned 0 [0123.836] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0123.836] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db")) returned 0 [0123.836] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{40FC8D7D-05ED-4FEB-B03B-6C100659EF5C}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{40fc8d7d-05ed-4feb-b03b-6c100659ef5c}.2.ver0x0000000000000001.db")) returned 0x2020 [0123.836] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab9fb9ff, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab9fb9ff, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab9fb9ff, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", cAlternateFileName="{4E426~2.DB")) returned 1 [0123.836] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0123.837] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0123.837] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x908 [0123.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0123.838] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0123.905] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x908, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x908, lpOverlapped=0x0) returned 1 [0123.907] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x910, lpOverlapped=0x0) returned 1 [0123.908] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0123.970] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0123.997] CloseHandle (hObject=0xec) returned 1 [0123.997] CloseHandle (hObject=0xe0) returned 1 [0123.999] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db.ozq0")) returned 0 [0124.000] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db.ozq0")) returned 0x2020 [0124.000] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab9fb9ff, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab9fb9ff, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab9fb9ff, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", cAlternateFileName="{4E426~2.DB")) returned 0x26dcd8 [0124.000] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab9fb9ff, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab9fb9ff, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab9fb9ff, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x908, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db", cAlternateFileName="{4E426~2.DB")) returned 0 [0124.000] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0124.000] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db")) returned 1 [0124.002] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{4E4260A4-7E39-442E-BC22-7FF751D1C161}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{4e4260a4-7e39-442e-bc22-7ff751d1c161}.2.ver0x0000000000000002.db")) returned 0xffffffff [0124.002] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf6c2bde, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf6c2bde, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf6c2bde, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2f088, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db", cAlternateFileName="{6AF06~3.DB")) returned 1 [0124.002] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0124.002] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0124.003] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f088 [0124.003] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0124.003] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0124.065] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2f088, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x2f088, lpOverlapped=0x0) returned 1 [0124.070] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2f090, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x2f090, lpOverlapped=0x0) returned 1 [0124.074] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.134] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.149] CloseHandle (hObject=0xe0) returned 1 [0124.150] CloseHandle (hObject=0xec) returned 1 [0124.156] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db.ozq0")) returned 0 [0124.156] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db.ozq0")) returned 0x2020 [0124.157] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf6c2bde, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf6c2bde, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf6c2bde, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2f088, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db", cAlternateFileName="{6AF06~3.DB")) returned 0x26dcd8 [0124.157] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcf6c2bde, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xcf6c2bde, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xcf6c2bde, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2f088, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db", cAlternateFileName="{6AF06~3.DB")) returned 0 [0124.157] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0124.157] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db")) returned 1 [0124.160] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000a.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000a.db")) returned 0xffffffff [0124.160] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd613c990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2f7d8, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db", cAlternateFileName="{6AF06~1.DB")) returned 1 [0124.160] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0124.160] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0124.161] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f7d8 [0124.161] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0124.161] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0124.216] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2f7d8, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x2f7d8, lpOverlapped=0x0) returned 1 [0124.225] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2f7e0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x2f7e0, lpOverlapped=0x0) returned 1 [0124.229] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.290] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.304] CloseHandle (hObject=0xec) returned 1 [0124.304] CloseHandle (hObject=0xe0) returned 1 [0124.308] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db.ozq0")) returned 0 [0124.308] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db.ozq0")) returned 0x2020 [0124.308] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd613c990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2f7d8, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db", cAlternateFileName="{6AF06~1.DB")) returned 0x26dcd8 [0124.309] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd613c990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd613c990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd613c990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2f7d8, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db", cAlternateFileName="{6AF06~1.DB")) returned 0 [0124.309] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0124.309] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db")) returned 0 [0124.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x000000000000000e.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x000000000000000e.db")) returned 0x2020 [0124.310] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd60f06d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd60f06d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd60f06d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db", cAlternateFileName="{87178~1.DB")) returned 1 [0124.310] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0124.311] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0124.311] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c0 [0124.311] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0124.312] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0124.368] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4c0, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x4c0, lpOverlapped=0x0) returned 1 [0124.369] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x4d0, lpOverlapped=0x0) returned 1 [0124.370] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.430] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.444] CloseHandle (hObject=0xe0) returned 1 [0124.444] CloseHandle (hObject=0xec) returned 1 [0124.458] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db.ozq0")) returned 0 [0124.459] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db.ozq0")) returned 0x2020 [0124.459] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd60f06d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd60f06d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd60f06d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db", cAlternateFileName="{87178~1.DB")) returned 0x26dcd8 [0124.459] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd60f06d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd60f06d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd60f06d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db", cAlternateFileName="{87178~1.DB")) returned 0 [0124.460] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0124.460] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db")) returned 0 [0124.460] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{87178F01-581A-45F0-9991-3F918FAA83F1}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{87178f01-581a-45f0-9991-3f918faa83f1}.2.ver0x0000000000000001.db")) returned 0x2020 [0124.461] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6116830, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd6116830, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd6116830, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db", cAlternateFileName="{C353F~1.DB")) returned 1 [0124.461] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0124.461] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0124.462] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x418 [0124.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0124.463] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0124.521] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x418, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x418, lpOverlapped=0x0) returned 1 [0124.522] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x420, lpOverlapped=0x0) returned 1 [0124.525] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.583] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.598] CloseHandle (hObject=0xec) returned 1 [0124.598] CloseHandle (hObject=0xe0) returned 1 [0124.599] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db.ozq0")) returned 0 [0124.600] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db.ozq0")) returned 0x2020 [0124.600] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6116830, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd6116830, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd6116830, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db", cAlternateFileName="{C353F~1.DB")) returned 0x26dcd8 [0124.601] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd6116830, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xd6116830, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xd6116830, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db", cAlternateFileName="{C353F~1.DB")) returned 0 [0124.601] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0124.601] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db")) returned 0 [0124.601] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{C353F91E-D25F-48F0-A2CD-9F60B2681E9A}.2.ver0x0000000000000001.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{c353f91e-d25f-48f0-a2cd-9f60b2681e9a}.2.ver0x0000000000000001.db")) returned 0x2020 [0124.601] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 1 [0124.601] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0124.602] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0124.603] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x65578 [0124.603] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0124.603] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0124.666] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x65578, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x65578, lpOverlapped=0x0) returned 1 [0124.680] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x65580, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x65580, lpOverlapped=0x0) returned 1 [0124.713] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.785] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.799] CloseHandle (hObject=0xe0) returned 1 [0124.799] CloseHandle (hObject=0xec) returned 1 [0124.805] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.ozq0")) returned 0 [0124.806] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db.ozq0")) returned 0x2020 [0124.806] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 0x26dcd8 [0124.806] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x26ee78, dwReserved1=0x18f0ac, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 0 [0124.806] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0124.807] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")) returned 0 [0124.807] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db" (normalized: "c:\\users\\all users\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000002.db")) returned 0x2020 [0124.807] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xab96347e, ftCreationTime.dwHighDateTime=0x1cb892d, ftLastAccessTime.dwLowDateTime=0xab96347e, ftLastAccessTime.dwHighDateTime=0x1cb892d, ftLastWriteTime.dwLowDateTime=0xab96347e, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x65578, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db", cAlternateFileName="{DDF57~2.DB")) returned 0 [0124.807] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0124.807] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d383945, dwReserved1=0x44363234, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0124.807] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd60 [0124.807] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0124.807] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="en-US", cAlternateFileName="")) returned 1 [0124.808] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc00da, dwReserved1=0x26ed88, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0124.808] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc00da, dwReserved1=0x26ed88, cFileName="..", cAlternateFileName="")) returned 1 [0124.808] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0xdc00da, dwReserved1=0x26ed88, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1 [0124.808] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0124.809] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0124.811] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3736 [0124.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0124.811] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0124.880] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3736, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x3736, lpOverlapped=0x0) returned 1 [0124.885] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x3740, lpOverlapped=0x0) returned 1 [0124.886] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0124.948] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0124.960] CloseHandle (hObject=0xe0) returned 1 [0124.961] CloseHandle (hObject=0xe8) returned 1 [0124.963] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.ozq0")) returned 0 [0124.963] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.ozq0")) returned 0x20 [0124.963] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x26feb0, dwReserved1=0x18ee44, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 0x26dd18 [0124.963] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x26feb0, dwReserved1=0x18ee44, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 0 [0124.963] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0124.964] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms")) returned 0 [0124.964] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms")) returned 0x20 [0124.964] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1 [0124.964] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0124.965] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0124.965] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1af79 [0124.965] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0124.966] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0125.019] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1af79, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1af79, lpOverlapped=0x0) returned 1 [0125.022] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1af80, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x1af80, lpOverlapped=0x0) returned 1 [0125.025] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.084] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.111] CloseHandle (hObject=0xe8) returned 1 [0125.111] CloseHandle (hObject=0xe0) returned 1 [0125.115] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.ozq0")) returned 0 [0125.115] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.ozq0")) returned 0x20 [0125.115] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x26feb0, dwReserved1=0x18ee44, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 0x26dd18 [0125.115] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x26feb0, dwReserved1=0x18ee44, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 0 [0125.115] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0125.116] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms")) returned 0 [0125.116] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\users\\all users\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms")) returned 0x20 [0125.116] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 0 [0125.116] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0125.116] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="en-US", cAlternateFileName="")) returned 0 [0125.116] FindClose (in: hFindFile=0x26dd60 | out: hFindFile=0x26dd60) returned 1 [0125.116] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d383945, dwReserved1=0x44363234, cFileName="DRM", cAlternateFileName="")) returned 1 [0125.116] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0125.117] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="..", cAlternateFileName="")) returned 1 [0125.117] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="Cache", cAlternateFileName="")) returned 1 [0125.117] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0125.117] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0125.118] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 0 [0125.118] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0125.118] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="Cache", cAlternateFileName="")) returned 0 [0125.118] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0125.118] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d383945, dwReserved1=0x44363234, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0125.118] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName=".", cAlternateFileName="")) returned 0x26dd50 [0125.118] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="..", cAlternateFileName="")) returned 1 [0125.119] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="..", cAlternateFileName="")) returned 0 [0125.119] FindClose (in: hFindFile=0x26dd50 | out: hFindFile=0x26dd50) returned 1 [0125.119] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc4247cc1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d383945, dwReserved1=0x44363234, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0125.119] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc4247cc1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName=".", cAlternateFileName="")) returned 0x26dd70 [0125.119] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc4247cc1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="..", cAlternateFileName="")) returned 1 [0125.119] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc4247cc1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="..", cAlternateFileName="")) returned 0 [0125.119] FindClose (in: hFindFile=0x26dd70 | out: hFindFile=0x26dd70) returned 1 [0125.119] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d383945, dwReserved1=0x44363234, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0125.120] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0125.160] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="..", cAlternateFileName="")) returned 1 [0125.160] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x342d3531, dwReserved1=0x2d383633, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0125.160] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0125.161] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0125.162] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x264 [0125.162] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0125.162] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0125.235] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x264, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x264, lpOverlapped=0x0) returned 1 [0125.236] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x270, lpOverlapped=0x0) returned 1 [0125.237] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.292] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.305] CloseHandle (hObject=0xec) returned 1 [0125.305] CloseHandle (hObject=0xe0) returned 1 [0125.307] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini.ozq0")) returned 0 [0125.307] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini.ozq0")) returned 0x2020 [0125.307] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x26ee18, dwReserved1=0x18f0ac, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dcd8 [0125.308] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x26ee18, dwReserved1=0x18f0ac, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0125.308] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0125.308] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini")) returned 1 [0125.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\desktop.ini")) returned 0xffffffff [0125.310] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0125.310] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0125.310] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0125.311] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31469 [0125.311] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0125.311] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0125.376] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x31469, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x31469, lpOverlapped=0x0) returned 1 [0125.383] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x31470, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x31470, lpOverlapped=0x0) returned 1 [0125.387] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.445] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.461] CloseHandle (hObject=0xe0) returned 1 [0125.461] CloseHandle (hObject=0xec) returned 1 [0125.466] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma.ozq0")) returned 0 [0125.467] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma.ozq0")) returned 0x2020 [0125.467] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 0x26dcd8 [0125.467] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 0 [0125.467] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0125.467] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma")) returned 1 [0125.470] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 01.wma")) returned 0xffffffff [0125.470] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0125.470] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0125.471] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0125.471] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21fbf [0125.471] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0125.471] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0125.536] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x21fbf, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x21fbf, lpOverlapped=0x0) returned 1 [0125.540] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x21fc0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x21fc0, lpOverlapped=0x0) returned 1 [0125.544] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.600] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.613] CloseHandle (hObject=0xec) returned 1 [0125.613] CloseHandle (hObject=0xe0) returned 1 [0125.616] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma.ozq0")) returned 0 [0125.616] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma.ozq0")) returned 0x2020 [0125.616] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 0x26dcd8 [0125.617] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 0 [0125.617] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0125.617] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma")) returned 1 [0125.619] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 02.wma")) returned 0xffffffff [0125.619] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0125.619] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0125.620] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0125.620] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x170f9 [0125.620] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0125.621] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0125.693] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x170f9, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x170f9, lpOverlapped=0x0) returned 1 [0125.696] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17100, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x17100, lpOverlapped=0x0) returned 1 [0125.699] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.754] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.767] CloseHandle (hObject=0xe0) returned 1 [0125.767] CloseHandle (hObject=0xec) returned 1 [0125.769] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma.ozq0")) returned 0 [0125.769] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma.ozq0")) returned 0x2020 [0125.770] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 0x26dcd8 [0125.770] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 0 [0125.770] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0125.770] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma")) returned 1 [0125.772] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 03.wma")) returned 0xffffffff [0125.772] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0125.772] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0125.772] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0125.773] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a039 [0125.773] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0125.773] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0125.828] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3a039, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x3a039, lpOverlapped=0x0) returned 1 [0125.833] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3a040, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x3a040, lpOverlapped=0x0) returned 1 [0125.837] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0125.903] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0125.915] CloseHandle (hObject=0xec) returned 1 [0125.916] CloseHandle (hObject=0xe0) returned 1 [0125.919] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma.ozq0")) returned 0 [0125.919] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma.ozq0")) returned 0x2020 [0125.920] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 0x26dcd8 [0125.920] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 0 [0125.920] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0125.920] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma")) returned 1 [0125.922] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 04.wma")) returned 0xffffffff [0125.922] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0125.923] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0125.923] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0125.923] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b6e1 [0125.923] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0125.924] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0125.980] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1b6e1, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1b6e1, lpOverlapped=0x0) returned 1 [0125.984] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1b6f0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1b6f0, lpOverlapped=0x0) returned 1 [0125.986] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.049] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.064] CloseHandle (hObject=0xe0) returned 1 [0126.064] CloseHandle (hObject=0xec) returned 1 [0126.067] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma.ozq0")) returned 0 [0126.067] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma.ozq0")) returned 0x2020 [0126.068] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 0x26dcd8 [0126.068] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 0 [0126.068] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.068] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma")) returned 1 [0126.070] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 05.wma")) returned 0xffffffff [0126.070] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0126.070] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0126.071] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0126.075] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x170f9 [0126.075] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0126.075] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0126.134] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x170f9, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x170f9, lpOverlapped=0x0) returned 1 [0126.159] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17100, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x17100, lpOverlapped=0x0) returned 1 [0126.162] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.220] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.234] CloseHandle (hObject=0xec) returned 1 [0126.235] CloseHandle (hObject=0xe0) returned 1 [0126.240] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma.ozq0")) returned 0 [0126.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma.ozq0")) returned 0x2020 [0126.240] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 0x26dcd8 [0126.240] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 0 [0126.240] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.241] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma")) returned 1 [0126.242] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 06.wma")) returned 0xffffffff [0126.242] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0126.242] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0126.243] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0126.243] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x170f9 [0126.243] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0126.244] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0126.302] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x170f9, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x170f9, lpOverlapped=0x0) returned 1 [0126.318] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17100, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x17100, lpOverlapped=0x0) returned 1 [0126.321] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.377] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.391] CloseHandle (hObject=0xe0) returned 1 [0126.391] CloseHandle (hObject=0xec) returned 1 [0126.393] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma.ozq0")) returned 0 [0126.394] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma.ozq0")) returned 0x2020 [0126.394] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 0x26dcd8 [0126.394] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 0 [0126.394] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.395] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma")) returned 1 [0126.396] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 07.wma")) returned 0xffffffff [0126.396] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0126.396] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0126.397] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0126.397] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x21fbd [0126.397] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0126.398] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0126.463] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x21fbd, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x21fbd, lpOverlapped=0x0) returned 1 [0126.534] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x21fc0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x21fc0, lpOverlapped=0x0) returned 1 [0126.537] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.600] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.612] CloseHandle (hObject=0xec) returned 1 [0126.613] CloseHandle (hObject=0xe0) returned 1 [0126.615] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma.ozq0")) returned 0 [0126.615] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma.ozq0")) returned 0x2020 [0126.615] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 0x26dcd8 [0126.616] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 0 [0126.616] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.616] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma")) returned 1 [0126.618] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 08.wma")) returned 0xffffffff [0126.618] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0126.618] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0126.618] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0126.619] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b6e1 [0126.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0126.619] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0126.668] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1b6e1, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1b6e1, lpOverlapped=0x0) returned 1 [0126.672] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1b6f0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1b6f0, lpOverlapped=0x0) returned 1 [0126.675] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.733] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.745] CloseHandle (hObject=0xe0) returned 1 [0126.746] CloseHandle (hObject=0xec) returned 1 [0126.751] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma.ozq0")) returned 0 [0126.751] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma.ozq0")) returned 0x2020 [0126.752] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 0x26dcd8 [0126.752] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 0 [0126.752] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.752] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma")) returned 1 [0126.753] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 09.wma")) returned 0xffffffff [0126.754] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0126.754] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0126.754] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0126.758] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x170f9 [0126.758] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0126.759] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0126.812] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x170f9, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x170f9, lpOverlapped=0x0) returned 1 [0126.832] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17100, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x17100, lpOverlapped=0x0) returned 1 [0126.835] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0126.905] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0126.920] CloseHandle (hObject=0xec) returned 1 [0126.921] CloseHandle (hObject=0xe0) returned 1 [0126.923] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma.ozq0")) returned 0 [0126.923] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma.ozq0")) returned 0x2020 [0126.924] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0x26dcd8 [0126.924] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0126.924] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.924] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma")) returned 1 [0126.928] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\users\\all users\\microsoft\\windows\\ringtones\\ringtone 10.wma")) returned 0xffffffff [0126.928] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0126.928] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0126.929] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616d772e, dwReserved1=0x44363234, cFileName="Sqm", cAlternateFileName="")) returned 1 [0126.929] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0126.930] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0126.931] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Manifest", cAlternateFileName="")) returned 1 [0126.931] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0126.932] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 1 [0126.932] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 0 [0126.932] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.932] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Sessions", cAlternateFileName="")) returned 1 [0126.932] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0126.933] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 1 [0126.933] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 0 [0126.933] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.933] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Upload", cAlternateFileName="")) returned 1 [0126.933] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0126.934] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 1 [0126.934] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 0 [0126.935] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0126.935] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa9fd6a20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xa9fd6a20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xa9fd6a20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Upload", cAlternateFileName="")) returned 0 [0126.935] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0126.935] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x616d772e, dwReserved1=0x44363234, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0126.935] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0126.936] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0126.936] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0126.936] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0126.937] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0126.940] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x502 [0126.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0126.940] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0127.000] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x502, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x502, lpOverlapped=0x0) returned 1 [0127.001] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x510, lpOverlapped=0x0) returned 1 [0127.002] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.065] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.082] CloseHandle (hObject=0xe0) returned 1 [0127.082] CloseHandle (hObject=0xec) returned 1 [0127.087] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk.ozq0")) returned 0 [0127.088] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk.ozq0")) returned 0x20 [0127.088] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x26ee30, dwReserved1=0x18f0ac, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 0x26dcd8 [0127.088] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x26ee30, dwReserved1=0x18f0ac, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 0 [0127.088] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0127.088] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk")) returned 1 [0127.090] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Default Programs.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\default programs.lnk")) returned 0xffffffff [0127.090] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0127.090] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0127.090] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0127.092] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ba [0127.092] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0127.093] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0127.153] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1ba, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1ba, lpOverlapped=0x0) returned 1 [0127.154] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1c0, lpOverlapped=0x0) returned 1 [0127.155] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.222] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.235] CloseHandle (hObject=0xec) returned 1 [0127.235] CloseHandle (hObject=0xe0) returned 1 [0127.238] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.ozq0")) returned 0 [0127.239] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini.ozq0")) returned 0x20 [0127.239] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dcd8 [0127.239] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0127.239] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0127.239] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0127.241] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\desktop.ini")) returned 0xffffffff [0127.241] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xad9c0910, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="Programs", cAlternateFileName="")) returned 1 [0127.241] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xad9c0910, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0127.241] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xad9c0910, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName="..", cAlternateFileName="")) returned 1 [0127.242] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad16bc10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad16bc10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad16bc10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x951, dwReserved0=0x780076, dwReserved1=0x25f898, cFileName="Access 2016.lnk", cAlternateFileName="ACCESS~1.LNK")) returned 1 [0127.242] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0127.259] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0127.260] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x951 [0127.260] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0127.261] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0127.316] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x951, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x951, lpOverlapped=0x0) returned 1 [0127.331] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x960, lpOverlapped=0x0) returned 1 [0127.332] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.392] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.406] CloseHandle (hObject=0xec) returned 1 [0127.406] CloseHandle (hObject=0xe8) returned 1 [0127.411] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.ozq0")) returned 0 [0127.411] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk.ozq0")) returned 0x20 [0127.411] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad16bc10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad16bc10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad16bc10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x951, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="Access 2016.lnk", cAlternateFileName="ACCESS~1.LNK")) returned 0x26fe38 [0127.412] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad16bc10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad16bc10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad16bc10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x951, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="Access 2016.lnk", cAlternateFileName="ACCESS~1.LNK")) returned 0 [0127.412] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0127.412] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk")) returned 1 [0127.413] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Access 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\access 2016.lnk")) returned 0xffffffff [0127.413] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd0587200, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0127.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd0587200, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x26fd98, cFileName=".", cAlternateFileName="")) returned 0x26fe38 [0127.413] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xd0587200, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x26fd98, cFileName="..", cAlternateFileName="")) returned 1 [0127.414] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x920090, dwReserved1=0x26fd98, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0127.414] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName=".", cAlternateFileName="")) returned 0x26fd98 [0127.414] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 1 [0127.414] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0127.414] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.414] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.418] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x172 [0127.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0127.418] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0127.473] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x172, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x172, lpOverlapped=0x0) returned 1 [0127.474] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x180, lpOverlapped=0x0) returned 1 [0127.475] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.532] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.544] CloseHandle (hObject=0xf0) returned 1 [0127.544] CloseHandle (hObject=0xf4) returned 1 [0127.547] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.ozq0")) returned 0 [0127.547] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.ozq0")) returned 0x20 [0127.547] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x271f58, dwReserved1=0x18e974, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x26fdd8 [0127.548] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x271f58, dwReserved1=0x18e974, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0127.548] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0127.548] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 1 [0127.549] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0xffffffff [0127.549] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1 [0127.549] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0127.550] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.551] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56c [0127.551] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0127.552] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0127.610] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x56c, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x56c, lpOverlapped=0x0) returned 1 [0127.666] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x570, lpOverlapped=0x0) returned 1 [0127.667] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.728] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.740] CloseHandle (hObject=0xf4) returned 1 [0127.741] CloseHandle (hObject=0xf0) returned 1 [0127.742] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.ozq0")) returned 0 [0127.742] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk.ozq0")) returned 0x20 [0127.743] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x271f70, dwReserved1=0x18e974, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0x26fdd8 [0127.743] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x271f70, dwReserved1=0x18e974, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0127.743] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0127.743] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk")) returned 1 [0127.744] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Speech Recognition.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\speech recognition.lnk")) returned 0xffffffff [0127.744] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0127.744] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0127.745] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x74696e67, dwReserved1=0x2e6e6f69, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0127.745] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0127.746] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.747] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ce [0127.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0127.747] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0127.806] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ce, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4ce, lpOverlapped=0x0) returned 1 [0127.818] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4d0, lpOverlapped=0x0) returned 1 [0127.820] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0127.935] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0127.953] CloseHandle (hObject=0xec) returned 1 [0127.953] CloseHandle (hObject=0xf0) returned 1 [0127.956] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.ozq0")) returned 0 [0127.957] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk.ozq0")) returned 0x20 [0127.957] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 0x26fd98 [0127.958] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 0 [0127.958] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0127.958] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk")) returned 1 [0127.960] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\calculator.lnk")) returned 0xffffffff [0127.960] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0127.960] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0127.960] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0127.962] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x73e [0127.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0127.963] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0128.037] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x73e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x73e, lpOverlapped=0x0) returned 1 [0128.040] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x740, lpOverlapped=0x0) returned 1 [0128.041] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.107] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.122] CloseHandle (hObject=0xf0) returned 1 [0128.122] CloseHandle (hObject=0xec) returned 1 [0128.124] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.ozq0")) returned 0 [0128.125] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.ozq0")) returned 0x20 [0128.125] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x26fd98 [0128.125] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0128.125] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0128.125] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0128.127] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0128.127] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1 [0128.127] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0128.127] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.132] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f2 [0128.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0128.132] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0128.192] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4f2, lpOverlapped=0x0) returned 1 [0128.193] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500, lpOverlapped=0x0) returned 1 [0128.195] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.253] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.267] CloseHandle (hObject=0xec) returned 1 [0128.267] CloseHandle (hObject=0xf0) returned 1 [0128.269] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.ozq0")) returned 0 [0128.269] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk.ozq0")) returned 0x20 [0128.269] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 0x26fd98 [0128.270] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 0 [0128.270] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0128.270] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk")) returned 1 [0128.271] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\displayswitch.lnk")) returned 0xffffffff [0128.271] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa5eae0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfa5eae0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f32b60, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1 [0128.271] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.273] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0128.274] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554 [0128.274] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0128.274] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0128.346] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x554, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x554, lpOverlapped=0x0) returned 1 [0128.348] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x560, lpOverlapped=0x0) returned 1 [0128.349] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.409] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.422] CloseHandle (hObject=0xf0) returned 1 [0128.423] CloseHandle (hObject=0xec) returned 1 [0128.424] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.ozq0")) returned 0 [0128.425] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk.ozq0")) returned 0x20 [0128.425] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa5eae0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfa5eae0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f32b60, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 0x26fd98 [0128.425] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa5eae0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfa5eae0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f32b60, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 0 [0128.425] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0128.425] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 1 [0128.427] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Math Input Panel.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\math input panel.lnk")) returned 0xffffffff [0128.427] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa5eae0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfa5eae0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfa84c40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1 [0128.427] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0128.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.431] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d6 [0128.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0128.432] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0128.492] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4d6, lpOverlapped=0x0) returned 1 [0128.495] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0128.496] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.555] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.568] CloseHandle (hObject=0xec) returned 1 [0128.568] CloseHandle (hObject=0xf0) returned 1 [0128.571] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.ozq0")) returned 0 [0128.572] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk.ozq0")) returned 0x20 [0128.572] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa5eae0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfa5eae0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfa84c40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 0x26fd98 [0128.572] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa5eae0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfa5eae0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfa84c40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 0 [0128.572] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0128.573] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk")) returned 1 [0128.574] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Mobility Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\mobility center.lnk")) returned 0xffffffff [0128.575] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf9c6560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcf9c6560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcf9c6560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1 [0128.575] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.575] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0128.576] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4da [0128.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0128.577] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0128.644] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4da, lpOverlapped=0x0) returned 1 [0128.645] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0128.651] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.727] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.738] CloseHandle (hObject=0xf0) returned 1 [0128.739] CloseHandle (hObject=0xec) returned 1 [0128.743] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.ozq0")) returned 0 [0128.744] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk.ozq0")) returned 0x20 [0128.744] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf9c6560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcf9c6560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcf9c6560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 0x26fd98 [0128.744] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf9c6560, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcf9c6560, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcf9c6560, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 0 [0128.744] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0128.744] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk")) returned 1 [0128.745] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\NetworkProjection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\networkprojection.lnk")) returned 0xffffffff [0128.745] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0128.745] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0128.746] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.746] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4da [0128.746] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0128.747] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0128.811] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4da, lpOverlapped=0x0) returned 1 [0128.812] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0128.813] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0128.907] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0128.922] CloseHandle (hObject=0xec) returned 1 [0128.923] CloseHandle (hObject=0xf0) returned 1 [0128.925] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.ozq0")) returned 0 [0128.928] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk.ozq0")) returned 0x20 [0128.928] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x270f30, dwReserved1=0x18ebdc, cFileName="Paint.lnk", cAlternateFileName="")) returned 0x26fd98 [0128.928] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x270f30, dwReserved1=0x18ebdc, cFileName="Paint.lnk", cAlternateFileName="")) returned 0 [0128.928] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0128.928] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 1 [0128.930] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\paint.lnk")) returned 0xffffffff [0128.930] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0128.930] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0128.931] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0128.932] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x557 [0128.932] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0128.932] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0129.000] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x557, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x557, lpOverlapped=0x0) returned 1 [0129.118] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x560, lpOverlapped=0x0) returned 1 [0129.120] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.189] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.206] CloseHandle (hObject=0xf0) returned 1 [0129.206] CloseHandle (hObject=0xec) returned 1 [0129.211] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.ozq0")) returned 0 [0129.211] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk.ozq0")) returned 0x20 [0129.211] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x270f58, dwReserved1=0x18ebdc, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0x26fd98 [0129.212] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x270f58, dwReserved1=0x18ebdc, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0129.212] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0129.212] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 1 [0129.213] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\remote desktop connection.lnk")) returned 0xffffffff [0129.213] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0587200, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0587200, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0587200, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1 [0129.213] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0129.215] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.216] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f8 [0129.216] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0129.217] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0129.287] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4f8, lpOverlapped=0x0) returned 1 [0129.294] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500, lpOverlapped=0x0) returned 1 [0129.296] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.372] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.387] CloseHandle (hObject=0xec) returned 1 [0129.387] CloseHandle (hObject=0xf0) returned 1 [0129.389] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.ozq0")) returned 0 [0129.390] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk.ozq0")) returned 0x20 [0129.390] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0587200, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0587200, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0587200, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 0x26fd98 [0129.390] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0587200, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0587200, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0587200, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 0 [0129.390] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0129.391] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 1 [0129.392] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\snipping tool.lnk")) returned 0xffffffff [0129.392] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1 [0129.393] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.393] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0129.394] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x532 [0129.396] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0129.397] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0129.492] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x532, lpOverlapped=0x0) returned 1 [0129.550] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x540, lpOverlapped=0x0) returned 1 [0129.552] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.609] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.622] CloseHandle (hObject=0xf0) returned 1 [0129.623] CloseHandle (hObject=0xec) returned 1 [0129.636] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.ozq0")) returned 0 [0129.637] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk.ozq0")) returned 0x20 [0129.637] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 0x26fd98 [0129.637] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 0 [0129.637] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0129.637] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk")) returned 1 [0129.638] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sound Recorder.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sound recorder.lnk")) returned 0xffffffff [0129.638] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfaaada0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfaaada0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfaaada0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1 [0129.638] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0129.639] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.640] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x547 [0129.640] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0129.640] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0129.705] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x547, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x547, lpOverlapped=0x0) returned 1 [0129.708] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x550, lpOverlapped=0x0) returned 1 [0129.709] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.774] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.787] CloseHandle (hObject=0xec) returned 1 [0129.787] CloseHandle (hObject=0xf0) returned 1 [0129.788] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.ozq0")) returned 0 [0129.789] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk.ozq0")) returned 0x20 [0129.789] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfaaada0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfaaada0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfaaada0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 0x26fd98 [0129.789] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfaaada0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfaaada0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfaaada0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 0 [0129.789] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0129.789] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk")) returned 1 [0129.790] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sticky notes.lnk")) returned 0xffffffff [0129.790] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1 [0129.791] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.791] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0129.792] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e6 [0129.792] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0129.792] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0129.852] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4e6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4e6, lpOverlapped=0x0) returned 1 [0129.877] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4f0, lpOverlapped=0x0) returned 1 [0129.879] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0129.945] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0129.959] CloseHandle (hObject=0xf0) returned 1 [0129.959] CloseHandle (hObject=0xec) returned 1 [0129.960] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.ozq0")) returned 0 [0129.961] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk.ozq0")) returned 0x20 [0129.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 0x26fd98 [0129.961] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 0 [0129.961] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0129.962] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk")) returned 1 [0129.963] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sync Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\sync center.lnk")) returned 0xffffffff [0129.963] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0129.963] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x270e80, cFileName=".", cAlternateFileName="")) returned 0x26fd98 [0129.963] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x270e80, cFileName="..", cAlternateFileName="")) returned 1 [0129.963] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0xaa00a8, dwReserved1=0x270e80, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1 [0129.963] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0129.964] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0129.965] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e0 [0129.965] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0129.965] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0130.027] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4e0, lpOverlapped=0x0) returned 1 [0130.070] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4f0, lpOverlapped=0x0) returned 1 [0130.071] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.133] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.145] CloseHandle (hObject=0xf0) returned 1 [0130.145] CloseHandle (hObject=0xf4) returned 1 [0130.147] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.ozq0")) returned 0 [0130.148] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk.ozq0")) returned 0x20 [0130.148] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 0x26fdd8 [0130.148] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 0 [0130.148] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0130.148] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 1 [0130.149] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Character Map.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\character map.lnk")) returned 0xffffffff [0130.150] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0130.150] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.150] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.151] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x53a [0130.151] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0130.151] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0130.201] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x53a, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x53a, lpOverlapped=0x0) returned 1 [0130.202] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x540, lpOverlapped=0x0) returned 1 [0130.203] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.259] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.272] CloseHandle (hObject=0xf4) returned 1 [0130.272] CloseHandle (hObject=0xf0) returned 1 [0130.274] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.ozq0")) returned 0 [0130.275] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.ozq0")) returned 0x20 [0130.275] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x271f58, dwReserved1=0x18e974, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x26fdd8 [0130.275] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x271f58, dwReserved1=0x18e974, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0130.275] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0130.275] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0130.278] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0xffffffff [0130.278] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0130.278] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.279] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.281] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50a [0130.281] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0130.281] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0130.366] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x50a, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x50a, lpOverlapped=0x0) returned 1 [0130.369] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x510, lpOverlapped=0x0) returned 1 [0130.370] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.430] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.445] CloseHandle (hObject=0xf0) returned 1 [0130.445] CloseHandle (hObject=0xf4) returned 1 [0130.448] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.ozq0")) returned 0 [0130.448] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk.ozq0")) returned 0x20 [0130.449] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x271f58, dwReserved1=0x18e974, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 0x26fdd8 [0130.449] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x271f58, dwReserved1=0x18e974, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 0 [0130.449] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0130.449] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk")) returned 1 [0130.451] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\dfrgui.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\dfrgui.lnk")) returned 0xffffffff [0130.451] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1 [0130.451] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.453] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.455] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e4 [0130.455] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0130.456] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0130.535] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4e4, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4e4, lpOverlapped=0x0) returned 1 [0130.536] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4f0, lpOverlapped=0x0) returned 1 [0130.538] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.592] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.605] CloseHandle (hObject=0xf4) returned 1 [0130.605] CloseHandle (hObject=0xf0) returned 1 [0130.611] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.ozq0")) returned 0 [0130.612] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk.ozq0")) returned 0x20 [0130.612] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x271f60, dwReserved1=0x18e974, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 0x26fdd8 [0130.612] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x271f60, dwReserved1=0x18e974, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 0 [0130.612] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0130.612] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk")) returned 1 [0130.614] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Disk Cleanup.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\disk cleanup.lnk")) returned 0xffffffff [0130.614] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1 [0130.614] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.615] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.617] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4da [0130.617] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0130.617] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0130.674] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4da, lpOverlapped=0x0) returned 1 [0130.676] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4e0, lpOverlapped=0x0) returned 1 [0130.677] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.734] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.746] CloseHandle (hObject=0xf0) returned 1 [0130.746] CloseHandle (hObject=0xf4) returned 1 [0130.748] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.ozq0")) returned 0 [0130.749] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk.ozq0")) returned 0x20 [0130.749] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 0x26fdd8 [0130.749] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 0 [0130.749] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0130.749] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk")) returned 1 [0130.751] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Resource Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\resource monitor.lnk")) returned 0xffffffff [0130.751] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0130.751] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.752] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.754] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e2 [0130.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0130.754] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0130.806] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4e2, lpOverlapped=0x0) returned 1 [0130.808] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4f0, lpOverlapped=0x0) returned 1 [0130.809] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0130.869] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0130.882] CloseHandle (hObject=0xf4) returned 1 [0130.882] CloseHandle (hObject=0xf0) returned 1 [0130.884] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.ozq0")) returned 0 [0130.885] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk.ozq0")) returned 0x20 [0130.885] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x271f70, dwReserved1=0x18e974, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 0x26fdd8 [0130.885] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x271f70, dwReserved1=0x18e974, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 0 [0130.885] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0130.885] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk")) returned 1 [0130.887] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Information.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system information.lnk")) returned 0xffffffff [0130.887] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1 [0130.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0130.888] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0130.889] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4de [0130.889] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0130.890] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0130.953] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4de, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4de, lpOverlapped=0x0) returned 1 [0130.982] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4e0, lpOverlapped=0x0) returned 1 [0130.983] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.039] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.051] CloseHandle (hObject=0xf0) returned 1 [0131.052] CloseHandle (hObject=0xf4) returned 1 [0131.055] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.ozq0")) returned 0 [0131.056] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk.ozq0")) returned 0x20 [0131.056] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 0x26fdd8 [0131.057] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 0 [0131.057] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0131.057] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk")) returned 1 [0131.060] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\System Restore.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\system restore.lnk")) returned 0xffffffff [0131.060] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0131.061] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.062] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.063] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f4 [0131.063] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0131.064] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0131.140] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4f4, lpOverlapped=0x0) returned 1 [0131.142] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x500, lpOverlapped=0x0) returned 1 [0131.143] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.212] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.227] CloseHandle (hObject=0xf4) returned 1 [0131.227] CloseHandle (hObject=0xf0) returned 1 [0131.229] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.ozq0")) returned 0 [0131.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk.ozq0")) returned 0x20 [0131.230] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 0x26fdd8 [0131.232] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 0 [0131.232] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0131.232] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk")) returned 1 [0131.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\task scheduler.lnk")) returned 0xffffffff [0131.234] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0131.234] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.240] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.241] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x528 [0131.241] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0131.241] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0131.307] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x528, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x528, lpOverlapped=0x0) returned 1 [0131.309] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x530, lpOverlapped=0x0) returned 1 [0131.310] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.369] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.381] CloseHandle (hObject=0xf0) returned 1 [0131.382] CloseHandle (hObject=0xf4) returned 1 [0131.384] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.ozq0")) returned 0 [0131.384] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk.ozq0")) returned 0x20 [0131.384] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x271f88, dwReserved1=0x18e974, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x26fdd8 [0131.385] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x271f88, dwReserved1=0x18e974, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0131.385] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0131.385] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk")) returned 1 [0131.386] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer Reports.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer reports.lnk")) returned 0xffffffff [0131.386] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0131.386] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.387] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.387] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x524 [0131.387] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0131.388] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0131.449] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x524, lpOverlapped=0x0) returned 1 [0131.453] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x530, lpOverlapped=0x0) returned 1 [0131.455] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.509] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.525] CloseHandle (hObject=0xf4) returned 1 [0131.525] CloseHandle (hObject=0xf0) returned 1 [0131.527] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.ozq0")) returned 0 [0131.527] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk.ozq0")) returned 0x20 [0131.527] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x271f78, dwReserved1=0x18e974, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x26fdd8 [0131.528] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x271f78, dwReserved1=0x18e974, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0131.528] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0131.528] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk")) returned 1 [0131.529] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Windows Easy Transfer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\windows easy transfer.lnk")) returned 0xffffffff [0131.529] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0131.530] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0131.530] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd009e4a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72542079, dwReserved1=0x66736e61, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0131.530] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd009e4a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26fd98 [0131.530] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xd009e4a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0131.530] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0131.530] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.530] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.531] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x157 [0131.531] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0131.533] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0131.614] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x157, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x157, lpOverlapped=0x0) returned 1 [0131.615] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x160, lpOverlapped=0x0) returned 1 [0131.616] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.678] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.690] CloseHandle (hObject=0xf0) returned 1 [0131.690] CloseHandle (hObject=0xf4) returned 1 [0131.769] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.ozq0")) returned 0 [0131.770] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini.ozq0")) returned 0x20 [0131.771] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x271f50, dwReserved1=0x18e974, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x26fdd8 [0131.771] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x271f50, dwReserved1=0x18e974, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0131.771] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0131.771] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini")) returned 1 [0131.774] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\desktop.ini")) returned 0xffffffff [0131.774] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd002c080, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd002c080, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd002c080, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1 [0131.774] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.774] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.776] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x59c [0131.776] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0131.777] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0131.831] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x59c, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x59c, lpOverlapped=0x0) returned 1 [0131.833] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x5a0, lpOverlapped=0x0) returned 1 [0131.834] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0131.905] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0131.938] CloseHandle (hObject=0xf4) returned 1 [0131.938] CloseHandle (hObject=0xf0) returned 1 [0131.939] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.ozq0")) returned 0 [0131.940] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk.ozq0")) returned 0x20 [0131.940] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd002c080, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd002c080, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd002c080, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x271f60, dwReserved1=0x18e974, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 0x26fdd8 [0131.940] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd002c080, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd002c080, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd002c080, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x271f60, dwReserved1=0x18e974, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 0 [0131.940] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0131.940] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk")) returned 1 [0131.942] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\ShapeCollector.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\shapecollector.lnk")) returned 0xffffffff [0131.942] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd009e4a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd009e4a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1 [0131.942] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0131.943] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0131.944] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x56a [0131.944] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0131.944] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0131.995] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x56a, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x56a, lpOverlapped=0x0) returned 1 [0131.996] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x570, lpOverlapped=0x0) returned 1 [0131.997] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.060] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.075] CloseHandle (hObject=0xf0) returned 1 [0132.075] CloseHandle (hObject=0xf4) returned 1 [0132.078] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.ozq0")) returned 0 [0132.079] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk.ozq0")) returned 0x20 [0132.079] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd009e4a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd009e4a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x271f50, dwReserved1=0x18e974, cFileName="TabTip.lnk", cAlternateFileName="")) returned 0x26fdd8 [0132.079] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd009e4a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd009e4a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd009e4a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x271f50, dwReserved1=0x18e974, cFileName="TabTip.lnk", cAlternateFileName="")) returned 0 [0132.079] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0132.079] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk")) returned 1 [0132.081] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\TabTip.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\tabtip.lnk")) returned 0xffffffff [0132.081] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfaf7060, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfaf7060, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfb1d1c0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0132.081] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.082] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.083] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x524 [0132.083] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0132.084] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0132.138] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x524, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x524, lpOverlapped=0x0) returned 1 [0132.141] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x530, lpOverlapped=0x0) returned 1 [0132.142] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.201] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.215] CloseHandle (hObject=0xf4) returned 1 [0132.216] CloseHandle (hObject=0xf0) returned 1 [0132.475] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.ozq0")) returned 0 [0132.476] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk.ozq0")) returned 0x20 [0132.476] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfaf7060, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfaf7060, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfb1d1c0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x271f60, dwReserved1=0x18e974, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x26fdd8 [0132.476] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfaf7060, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfaf7060, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfb1d1c0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x271f60, dwReserved1=0x18e974, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0132.476] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0132.477] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 1 [0132.479] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Windows Journal.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\tablet pc\\windows journal.lnk")) returned 0xffffffff [0132.480] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfaf7060, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcfaf7060, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcfb1d1c0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0132.480] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0132.491] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x6c616e72, dwReserved1=0x6b6e6c2e, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1 [0132.494] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0132.495] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0132.496] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x62b [0132.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0132.497] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0132.561] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x62b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x62b, lpOverlapped=0x0) returned 1 [0132.568] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x630, lpOverlapped=0x0) returned 1 [0132.569] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.632] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.648] CloseHandle (hObject=0xec) returned 1 [0132.649] CloseHandle (hObject=0xf0) returned 1 [0132.651] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.ozq0")) returned 0 [0132.652] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk.ozq0")) returned 0x20 [0132.652] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 0x26fd98 [0132.652] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 0 [0132.652] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0132.652] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk")) returned 1 [0132.654] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\welcome center.lnk")) returned 0xffffffff [0132.654] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x48f5f820, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0132.654] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x48f5f820, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb000ae, dwReserved1=0x270e80, cFileName=".", cAlternateFileName="")) returned 0x26fd98 [0132.654] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x48f5f820, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb000ae, dwReserved1=0x270e80, cFileName="..", cAlternateFileName="")) returned 1 [0132.654] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0xb000ae, dwReserved1=0x270e80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0132.655] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0132.655] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.657] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8 [0132.657] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0132.657] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0132.719] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xd8, lpOverlapped=0x0) returned 1 [0132.720] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xe0, lpOverlapped=0x0) returned 1 [0132.721] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.778] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.791] CloseHandle (hObject=0xec) returned 1 [0132.791] CloseHandle (hObject=0xf4) returned 1 [0132.793] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini.ozq0")) returned 0 [0132.794] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini.ozq0")) returned 0x20 [0132.794] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fdd8 [0132.795] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x271f68, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0132.795] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0132.795] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini")) returned 1 [0132.796] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\desktop.ini")) returned 0xffffffff [0132.796] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3e96f0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3e96f0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0132.796] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.796] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0132.798] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8bc [0132.798] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0132.798] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0132.846] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8bc, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x8bc, lpOverlapped=0x0) returned 1 [0132.847] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x8c0, lpOverlapped=0x0) returned 1 [0132.848] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0132.907] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0132.944] CloseHandle (hObject=0xf4) returned 1 [0132.945] CloseHandle (hObject=0xec) returned 1 [0132.973] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.ozq0")) returned 0 [0132.974] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk.ozq0")) returned 0x20 [0132.974] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3e96f0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3e96f0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x271f88, dwReserved1=0x18e974, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x26fdd8 [0132.975] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3e96f0a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3e96f0a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x271f88, dwReserved1=0x18e974, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0132.975] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0132.975] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk")) returned 1 [0132.979] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell (x86).lnk")) returned 0xffffffff [0132.979] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x6b1, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0132.979] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0132.979] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0132.983] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b1 [0132.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0132.984] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0133.035] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6b1, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x6b1, lpOverlapped=0x0) returned 1 [0133.036] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x6c0, lpOverlapped=0x0) returned 1 [0133.036] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.117] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.129] CloseHandle (hObject=0xec) returned 1 [0133.129] CloseHandle (hObject=0xf4) returned 1 [0133.132] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.ozq0")) returned 0 [0133.133] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk.ozq0")) returned 0x20 [0133.133] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x6b1, dwReserved0=0x271f90, dwReserved1=0x18e974, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0x26fdd8 [0133.133] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e8d6e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x6b1, dwReserved0=0x271f90, dwReserved1=0x18e974, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0 [0133.133] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0133.133] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk")) returned 1 [0133.134] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE (x86).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise (x86).lnk")) returned 0xffffffff [0133.135] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e1b2c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x6b1, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0133.135] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.135] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0133.137] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6b1 [0133.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0133.137] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0133.192] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6b1, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x6b1, lpOverlapped=0x0) returned 1 [0133.192] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x6c0, lpOverlapped=0x0) returned 1 [0133.193] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.253] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.269] CloseHandle (hObject=0xf4) returned 1 [0133.269] CloseHandle (hObject=0xec) returned 1 [0133.271] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.ozq0")) returned 0 [0133.272] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk.ozq0")) returned 0x20 [0133.272] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e1b2c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x6b1, dwReserved0=0x271f80, dwReserved1=0x18e974, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0x26fdd8 [0133.272] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x66e1b2c0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x6b1, dwReserved0=0x271f80, dwReserved1=0x18e974, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0 [0133.272] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0133.273] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk")) returned 1 [0133.274] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell ISE.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell ise.lnk")) returned 0xffffffff [0133.274] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3e995200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3e995200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0133.275] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0133.275] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.277] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8bc [0133.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0133.277] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0133.338] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8bc, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x8bc, lpOverlapped=0x0) returned 1 [0133.339] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x8c0, lpOverlapped=0x0) returned 1 [0133.339] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.399] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.412] CloseHandle (hObject=0xec) returned 1 [0133.413] CloseHandle (hObject=0xf4) returned 1 [0133.415] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.ozq0")) returned 0 [0133.415] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk.ozq0")) returned 0x20 [0133.415] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3e995200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3e995200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x271f78, dwReserved1=0x18e974, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x26fdd8 [0133.416] FindNextFileA (in: hFindFile=0x26fdd8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3e995200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3e995200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x271f78, dwReserved1=0x18e974, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0133.416] FindClose (in: hFindFile=0x26fdd8 | out: hFindFile=0x26fdd8) returned 1 [0133.416] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk")) returned 1 [0133.418] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\windows powershell\\windows powershell.lnk")) returned 0xffffffff [0133.419] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3e995200, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3e995200, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x8bc, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0133.419] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0133.419] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x68537265, dwReserved1=0x2e6c6c65, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0133.419] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.420] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.420] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52a [0133.421] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0133.421] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0133.479] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x52a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x52a, lpOverlapped=0x0) returned 1 [0133.481] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x530, lpOverlapped=0x0) returned 1 [0133.483] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.542] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.558] CloseHandle (hObject=0xf0) returned 1 [0133.559] CloseHandle (hObject=0xf4) returned 1 [0133.560] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.ozq0")) returned 0 [0133.561] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk.ozq0")) returned 0x20 [0133.561] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0x26fd98 [0133.561] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0133.561] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0133.561] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 1 [0133.563] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Wordpad.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\accessories\\wordpad.lnk")) returned 0xffffffff [0133.563] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x68537265, dwReserved1=0x2e6c6c65, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0133.563] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0133.563] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3cdc30e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3cdc30e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68537265, dwReserved1=0x6e6c6c65, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0133.563] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3cdc30e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3cdc30e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fe48 [0133.563] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x3cdc30e0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x3cdc30e0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0133.563] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1 [0133.564] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.564] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.565] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4da [0133.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0133.565] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0133.619] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4da, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4da, lpOverlapped=0x0) returned 1 [0133.620] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0133.621] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.683] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.698] CloseHandle (hObject=0xf4) returned 1 [0133.698] CloseHandle (hObject=0xf0) returned 1 [0133.700] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.ozq0")) returned 0 [0133.713] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk.ozq0")) returned 0x20 [0133.714] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 0x26fd98 [0133.714] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 0 [0133.714] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0133.714] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 1 [0133.715] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Component Services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\component services.lnk")) returned 0xffffffff [0133.715] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1 [0133.715] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.715] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.716] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50e [0133.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0133.717] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0133.797] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x50e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x50e, lpOverlapped=0x0) returned 1 [0133.798] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x510, lpOverlapped=0x0) returned 1 [0133.799] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0133.871] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0133.887] CloseHandle (hObject=0xf0) returned 1 [0133.888] CloseHandle (hObject=0xf4) returned 1 [0133.889] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.ozq0")) returned 0 [0133.890] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk.ozq0")) returned 0x20 [0133.890] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 0x26fd98 [0133.890] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 0 [0133.890] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0133.891] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 1 [0133.892] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Computer Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\computer management.lnk")) returned 0xffffffff [0133.892] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1 [0133.892] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0133.893] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0133.894] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f6 [0133.894] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0133.894] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0133.986] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4f6, lpOverlapped=0x0) returned 1 [0133.986] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500, lpOverlapped=0x0) returned 1 [0133.987] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.044] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.080] CloseHandle (hObject=0xf4) returned 1 [0134.080] CloseHandle (hObject=0xf0) returned 1 [0134.084] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.ozq0")) returned 0 [0134.085] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk.ozq0")) returned 0x20 [0134.085] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 0x26fd98 [0134.086] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 0 [0134.086] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0134.086] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk")) returned 1 [0134.088] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Data Sources (ODBC).lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\data sources (odbc).lnk")) returned 0xffffffff [0134.088] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd053af40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0134.088] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.088] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0134.090] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7a6 [0134.090] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0134.091] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0134.143] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7a6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x7a6, lpOverlapped=0x0) returned 1 [0134.144] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x7b0, lpOverlapped=0x0) returned 1 [0134.145] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.220] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.232] CloseHandle (hObject=0xf0) returned 1 [0134.233] CloseHandle (hObject=0xf4) returned 1 [0134.234] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.ozq0")) returned 0 [0134.235] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.ozq0")) returned 0x20 [0134.235] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd053af40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x270f58, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fd98 [0134.235] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd053af40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x270f58, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0134.235] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0134.235] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0134.237] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0xffffffff [0134.237] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1 [0134.237] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0134.237] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.238] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x512 [0134.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0134.238] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0134.291] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x512, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x512, lpOverlapped=0x0) returned 1 [0134.291] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x520, lpOverlapped=0x0) returned 1 [0134.318] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.375] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.386] CloseHandle (hObject=0xf4) returned 1 [0134.387] CloseHandle (hObject=0xf0) returned 1 [0134.476] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.ozq0")) returned 0 [0134.477] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk.ozq0")) returned 0x20 [0134.478] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x270f60, dwReserved1=0x18ebdc, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 0x26fd98 [0134.478] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x270f60, dwReserved1=0x18ebdc, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 0 [0134.478] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0134.479] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 1 [0134.482] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Event Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\event viewer.lnk")) returned 0xffffffff [0134.482] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1 [0134.482] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.483] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0134.485] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fa [0134.485] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0134.485] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0134.545] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4fa, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4fa, lpOverlapped=0x0) returned 1 [0134.546] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500, lpOverlapped=0x0) returned 1 [0134.548] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.615] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.632] CloseHandle (hObject=0xf0) returned 1 [0134.633] CloseHandle (hObject=0xf4) returned 1 [0134.634] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.ozq0")) returned 0 [0134.635] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk.ozq0")) returned 0x20 [0134.635] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x270f68, dwReserved1=0x18ebdc, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 0x26fd98 [0134.635] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x270f68, dwReserved1=0x18ebdc, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 0 [0134.636] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0134.636] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 1 [0134.638] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\iSCSI Initiator.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\iscsi initiator.lnk")) returned 0xffffffff [0134.638] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1 [0134.638] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0134.638] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.640] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f4 [0134.640] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0134.640] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0134.702] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4f4, lpOverlapped=0x0) returned 1 [0134.703] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500, lpOverlapped=0x0) returned 1 [0134.704] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.766] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.781] CloseHandle (hObject=0xf4) returned 1 [0134.781] CloseHandle (hObject=0xf0) returned 1 [0134.784] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.ozq0")) returned 0 [0134.785] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk.ozq0")) returned 0x20 [0134.785] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x270f78, dwReserved1=0x18ebdc, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 0x26fd98 [0134.785] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x270f78, dwReserved1=0x18ebdc, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 0 [0134.786] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0134.786] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 1 [0134.787] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Memory Diagnostics Tool.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\memory diagnostics tool.lnk")) returned 0xffffffff [0134.787] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1 [0134.788] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.788] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0134.789] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d0 [0134.789] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0134.790] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0134.852] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4d0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4d0, lpOverlapped=0x0) returned 1 [0134.853] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0134.854] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0134.921] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0134.937] CloseHandle (hObject=0xf0) returned 1 [0134.937] CloseHandle (hObject=0xf4) returned 1 [0134.939] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.ozq0")) returned 0 [0134.939] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk.ozq0")) returned 0x20 [0134.939] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 0x26fd98 [0134.940] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 0 [0134.940] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0134.940] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 1 [0134.941] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Performance Monitor.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\performance monitor.lnk")) returned 0xffffffff [0134.941] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf54fc20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcf54fc20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcf575d80, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1 [0134.941] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0134.941] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0134.952] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ee [0134.952] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0134.953] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0135.014] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4ee, lpOverlapped=0x0) returned 1 [0135.015] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4f0, lpOverlapped=0x0) returned 1 [0135.016] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.080] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.097] CloseHandle (hObject=0xf4) returned 1 [0135.097] CloseHandle (hObject=0xf0) returned 1 [0135.100] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.ozq0")) returned 0 [0135.101] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk.ozq0")) returned 0x20 [0135.101] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf54fc20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcf54fc20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcf575d80, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x270f68, dwReserved1=0x18ebdc, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 0x26fd98 [0135.101] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf54fc20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xcf54fc20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xcf575d80, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x270f68, dwReserved1=0x18ebdc, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 0 [0135.101] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0135.101] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 1 [0135.103] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Print Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\print management.lnk")) returned 0xffffffff [0135.103] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd053af40, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd053af40, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd053af40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1 [0135.103] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.104] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0135.105] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e0 [0135.105] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0135.106] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0135.158] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0135.159] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4f0, lpOverlapped=0x0) returned 1 [0135.160] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.233] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.248] CloseHandle (hObject=0xf0) returned 1 [0135.249] CloseHandle (hObject=0xf4) returned 1 [0135.250] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.ozq0")) returned 0 [0135.251] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk.ozq0")) returned 0x20 [0135.251] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd053af40, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd053af40, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd053af40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x270f90, dwReserved1=0x18ebdc, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 0x26fd98 [0135.251] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd053af40, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd053af40, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd053af40, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x270f90, dwReserved1=0x18ebdc, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 0 [0135.252] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0135.252] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 1 [0135.254] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Security Configuration Management.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\security configuration management.lnk")) returned 0xffffffff [0135.254] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0135.254] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0135.254] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.256] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x508 [0135.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0135.256] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0135.323] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x508, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x508, lpOverlapped=0x0) returned 1 [0135.325] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x510, lpOverlapped=0x0) returned 1 [0135.326] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.396] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.408] CloseHandle (hObject=0xf4) returned 1 [0135.409] CloseHandle (hObject=0xf0) returned 1 [0135.411] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.ozq0")) returned 0 [0135.412] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk.ozq0")) returned 0x20 [0135.412] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x270f58, dwReserved1=0x18ebdc, cFileName="services.lnk", cAlternateFileName="")) returned 0x26fd98 [0135.412] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x270f58, dwReserved1=0x18ebdc, cFileName="services.lnk", cAlternateFileName="")) returned 0 [0135.412] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0135.412] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 1 [0135.413] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\services.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\services.lnk")) returned 0xffffffff [0135.413] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0135.414] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.414] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0135.414] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4de [0135.414] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0135.415] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0135.477] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4de, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4de, lpOverlapped=0x0) returned 1 [0135.478] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0135.481] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.542] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.558] CloseHandle (hObject=0xf0) returned 1 [0135.559] CloseHandle (hObject=0xf4) returned 1 [0135.561] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.ozq0")) returned 0 [0135.562] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk.ozq0")) returned 0x20 [0135.562] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 0x26fd98 [0135.562] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x270f70, dwReserved1=0x18ebdc, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 0 [0135.562] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0135.562] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 1 [0135.564] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Configuration.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\system configuration.lnk")) returned 0xffffffff [0135.564] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0135.564] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0135.564] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.565] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ee [0135.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0135.566] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0135.621] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4ee, lpOverlapped=0x0) returned 1 [0135.621] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4f0, lpOverlapped=0x0) returned 1 [0135.623] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.688] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.702] CloseHandle (hObject=0xf4) returned 1 [0135.702] CloseHandle (hObject=0xf0) returned 1 [0135.703] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.ozq0")) returned 0 [0135.704] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk.ozq0")) returned 0x20 [0135.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x270f68, dwReserved1=0x18ebdc, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 0x26fd98 [0135.704] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x270f68, dwReserved1=0x18ebdc, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 0 [0135.704] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0135.705] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 1 [0135.706] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Task Scheduler.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\task scheduler.lnk")) returned 0xffffffff [0135.706] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0135.706] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0135.706] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0135.707] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fa [0135.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0135.707] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0135.756] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4fa, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4fa, lpOverlapped=0x0) returned 1 [0135.757] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500, lpOverlapped=0x0) returned 1 [0135.758] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.819] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.831] CloseHandle (hObject=0xf0) returned 1 [0135.831] CloseHandle (hObject=0xf4) returned 1 [0135.832] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.ozq0")) returned 0 [0135.833] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk.ozq0")) returned 0x20 [0135.833] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x270f98, dwReserved1=0x18ebdc, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x26fd98 [0135.833] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x270f98, dwReserved1=0x18ebdc, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0135.833] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0135.833] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 1 [0135.834] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\Windows Firewall with Advanced Security.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\administrative tools\\windows firewall with advanced security.lnk")) returned 0xffffffff [0135.834] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0135.834] FindClose (in: hFindFile=0x26fe48 | out: hFindFile=0x26fe48) returned 1 [0135.835] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd0f7ee20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x6c617765, dwReserved1=0x6977206c, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0135.835] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0135.835] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0135.835] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x46a [0135.835] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0135.836] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0135.899] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x46a, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x46a, lpOverlapped=0x0) returned 1 [0135.899] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x470, lpOverlapped=0x0) returned 1 [0135.901] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0135.961] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0135.983] CloseHandle (hObject=0xe8) returned 1 [0135.983] CloseHandle (hObject=0xf4) returned 1 [0135.985] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.ozq0")) returned 0 [0135.986] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini.ozq0")) returned 0x20 [0135.986] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd0f7ee20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x26fe38, dwReserved1=0x18ee44, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fe30 [0135.986] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd0f7ee20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x26fe38, dwReserved1=0x18ee44, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0135.986] FindClose (in: hFindFile=0x26fe30 | out: hFindFile=0x26fe30) returned 1 [0135.986] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0135.988] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0xffffffff [0135.988] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 1 [0135.988] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0135.989] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0135.990] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x950 [0135.990] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0135.990] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0136.045] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x950, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x950, lpOverlapped=0x0) returned 1 [0136.051] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x960, lpOverlapped=0x0) returned 1 [0136.053] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.114] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.126] CloseHandle (hObject=0xf4) returned 1 [0136.126] CloseHandle (hObject=0xe8) returned 1 [0136.382] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.ozq0")) returned 0 [0136.383] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk.ozq0")) returned 0x20 [0136.383] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 0x26fe30 [0136.383] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 0 [0136.383] FindClose (in: hFindFile=0x26fe30 | out: hFindFile=0x26fe30) returned 1 [0136.384] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk")) returned 1 [0136.386] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Excel 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\excel 2016.lnk")) returned 0xffffffff [0136.386] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Games", cAlternateFileName="")) returned 1 [0136.386] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x26fd98, cFileName=".", cAlternateFileName="")) returned 0x26fe28 [0136.386] FindNextFileA (in: hFindFile=0x26fe28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x26fd98, cFileName="..", cAlternateFileName="")) returned 1 [0136.386] FindNextFileA (in: hFindFile=0x26fe28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x90008e, dwReserved1=0x26fd98, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0136.387] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0136.387] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.388] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x208 [0136.388] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0136.389] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0136.441] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x208, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x208, lpOverlapped=0x0) returned 1 [0136.442] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x210, lpOverlapped=0x0) returned 1 [0136.443] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.512] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.527] CloseHandle (hObject=0xf4) returned 1 [0136.527] CloseHandle (hObject=0xf0) returned 1 [0136.529] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini.ozq0")) returned 0 [0136.529] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini.ozq0")) returned 0x20 [0136.529] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fd98 [0136.530] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x270f18, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0136.530] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0136.530] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini")) returned 1 [0136.531] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\desktop.ini")) returned 0xffffffff [0136.532] FindNextFileA (in: hFindFile=0x26fe28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1 [0136.532] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.533] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0136.558] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102 [0136.558] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0136.559] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0136.609] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x102, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x102, lpOverlapped=0x0) returned 1 [0136.610] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0136.611] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.667] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.680] CloseHandle (hObject=0xf0) returned 1 [0136.681] CloseHandle (hObject=0xf4) returned 1 [0136.683] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.ozq0")) returned 0 [0136.683] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk.ozq0")) returned 0x20 [0136.684] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x270f28, dwReserved1=0x18ebdc, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0x26fd98 [0136.684] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x270f28, dwReserved1=0x18ebdc, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0136.684] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0136.684] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk")) returned 1 [0136.687] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\GameExplorer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\games\\gameexplorer.lnk")) returned 0xffffffff [0136.687] FindNextFileA (in: hFindFile=0x26fe28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0136.687] FindClose (in: hFindFile=0x26fe28 | out: hFindFile=0x26fe28) returned 1 [0136.688] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e6c2e72, dwReserved1=0x76653c6b, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0136.688] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fe38 [0136.688] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0136.688] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1 [0136.688] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0136.689] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.690] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x518 [0136.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0136.691] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0136.763] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x518, lpOverlapped=0x0) returned 1 [0136.765] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x520, lpOverlapped=0x0) returned 1 [0136.766] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.829] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.841] CloseHandle (hObject=0xf4) returned 1 [0136.841] CloseHandle (hObject=0xf0) returned 1 [0136.843] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.ozq0")) returned 0 [0136.844] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk.ozq0")) returned 0x20 [0136.844] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x270f58, dwReserved1=0x18ebdc, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 0x26fd98 [0136.844] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x270f58, dwReserved1=0x18ebdc, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 0 [0136.844] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0136.844] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk")) returned 1 [0136.845] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Backup and Restore Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\backup and restore center.lnk")) returned 0xffffffff [0136.845] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1 [0136.845] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.846] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0136.847] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e0 [0136.847] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0136.848] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0136.903] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4e0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0136.905] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4f0, lpOverlapped=0x0) returned 1 [0136.906] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0136.968] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0136.980] CloseHandle (hObject=0xf0) returned 1 [0136.980] CloseHandle (hObject=0xf4) returned 1 [0136.990] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.ozq0")) returned 0 [0136.991] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk.ozq0")) returned 0x20 [0136.991] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x270f50, dwReserved1=0x18ebdc, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 0x26fd98 [0136.992] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x270f50, dwReserved1=0x18ebdc, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 0 [0136.993] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0136.993] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk")) returned 1 [0136.996] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Create Recovery Disc.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\create recovery disc.lnk")) returned 0xffffffff [0136.996] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0136.996] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0136.997] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0136.999] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25e [0136.999] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0137.000] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0137.098] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x25e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x25e, lpOverlapped=0x0) returned 1 [0137.100] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x260, lpOverlapped=0x0) returned 1 [0137.102] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.180] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.196] CloseHandle (hObject=0xf4) returned 1 [0137.196] CloseHandle (hObject=0xf0) returned 1 [0137.198] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.ozq0")) returned 0 [0137.198] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.ozq0")) returned 0x20 [0137.199] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x26fd98 [0137.199] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0137.199] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0137.199] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0137.200] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0137.201] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0137.201] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.201] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0137.202] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4bc [0137.202] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0137.203] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0137.255] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4bc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4bc, lpOverlapped=0x0) returned 1 [0137.257] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4c0, lpOverlapped=0x0) returned 1 [0137.258] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.318] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.330] CloseHandle (hObject=0xf0) returned 1 [0137.330] CloseHandle (hObject=0xf4) returned 1 [0137.332] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.ozq0")) returned 0 [0137.333] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk.ozq0")) returned 0x20 [0137.333] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0x26fd98 [0137.333] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x270f48, dwReserved1=0x18ebdc, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0137.333] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0137.333] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk")) returned 1 [0137.334] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Remote Assistance.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\maintenance\\remote assistance.lnk")) returned 0xffffffff [0137.334] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0137.334] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0137.335] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0f7ee20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0f7ee20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f7ee20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x6e617473, dwReserved1=0x6c2e6563, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0137.338] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0137.339] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0137.339] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x541 [0137.339] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0137.340] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0137.392] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x541, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x541, lpOverlapped=0x0) returned 1 [0137.394] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x550, lpOverlapped=0x0) returned 1 [0137.395] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.458] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.471] CloseHandle (hObject=0xe8) returned 1 [0137.472] CloseHandle (hObject=0xf4) returned 1 [0137.474] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk.ozq0")) returned 0 [0137.475] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk.ozq0")) returned 0x20 [0137.475] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0f7ee20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0f7ee20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f7ee20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 0x26fe38 [0137.475] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0f7ee20, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0f7ee20, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f7ee20, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 0 [0137.477] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0137.477] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk")) returned 1 [0137.479] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Media Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\media center.lnk")) returned 0xffffffff [0137.479] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0137.479] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x26fd98, cFileName=".", cAlternateFileName="")) returned 0x26fe58 [0137.480] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x26fd98, cFileName="..", cAlternateFileName="")) returned 1 [0137.480] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x940092, dwReserved1=0x26fd98, cFileName="Database Compare 2016.lnk", cAlternateFileName="DATABA~1.LNK")) returned 1 [0137.480] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0137.481] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.482] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ea [0137.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0137.482] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0137.544] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9ea, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9ea, lpOverlapped=0x0) returned 1 [0137.560] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9f0, lpOverlapped=0x0) returned 1 [0137.562] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.622] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.636] CloseHandle (hObject=0xe8) returned 1 [0137.636] CloseHandle (hObject=0xf0) returned 1 [0137.638] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.ozq0")) returned 0 [0137.639] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk.ozq0")) returned 0x20 [0137.639] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x270f90, dwReserved1=0x18ebdc, cFileName="Database Compare 2016.lnk", cAlternateFileName="DATABA~1.LNK")) returned 0x26fd98 [0137.639] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x270f90, dwReserved1=0x18ebdc, cFileName="Database Compare 2016.lnk", cAlternateFileName="DATABA~1.LNK")) returned 0 [0137.639] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0137.640] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk")) returned 1 [0137.641] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Database Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\database compare 2016.lnk")) returned 0xffffffff [0137.641] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x965, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Office 2016 Language Preferences.lnk", cAlternateFileName="OFFICE~1.LNK")) returned 1 [0137.641] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.642] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0137.642] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x965 [0137.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0137.643] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0137.692] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x965, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x965, lpOverlapped=0x0) returned 1 [0137.699] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x970, lpOverlapped=0x0) returned 1 [0137.700] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.755] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.767] CloseHandle (hObject=0xf0) returned 1 [0137.767] CloseHandle (hObject=0xe8) returned 1 [0137.768] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.ozq0")) returned 0 [0137.769] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk.ozq0")) returned 0x20 [0137.769] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x965, dwReserved0=0x270fa8, dwReserved1=0x18ebdc, cFileName="Office 2016 Language Preferences.lnk", cAlternateFileName="OFFICE~1.LNK")) returned 0x26fd98 [0137.769] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x965, dwReserved0=0x270fa8, dwReserved1=0x18ebdc, cFileName="Office 2016 Language Preferences.lnk", cAlternateFileName="OFFICE~1.LNK")) returned 0 [0137.769] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0137.769] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk")) returned 1 [0137.770] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Language Preferences.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 language preferences.lnk")) returned 0xffffffff [0137.770] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad62e810, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Office 2016 Upload Center.lnk", cAlternateFileName="OFFICE~2.LNK")) returned 1 [0137.771] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0137.771] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.772] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9fe [0137.772] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0137.773] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0137.833] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9fe, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9fe, lpOverlapped=0x0) returned 1 [0137.834] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0137.835] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0137.893] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0137.917] CloseHandle (hObject=0xe8) returned 1 [0137.918] CloseHandle (hObject=0xf0) returned 1 [0137.919] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.ozq0")) returned 0 [0137.920] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk.ozq0")) returned 0x20 [0137.920] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad62e810, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x270f98, dwReserved1=0x18ebdc, cFileName="Office 2016 Upload Center.lnk", cAlternateFileName="OFFICE~2.LNK")) returned 0x26fd98 [0137.920] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad191d70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad191d70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad62e810, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9fe, dwReserved0=0x270f98, dwReserved1=0x18ebdc, cFileName="Office 2016 Upload Center.lnk", cAlternateFileName="OFFICE~2.LNK")) returned 0 [0137.920] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0137.921] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk")) returned 1 [0137.922] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Office 2016 Upload Center.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\office 2016 upload center.lnk")) returned 0xffffffff [0137.922] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7ab5d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7ab5d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7ab5d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Skype for Business Recording Manager.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0137.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0137.923] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0137.924] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97e [0137.924] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0137.924] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0138.030] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x97e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x97e, lpOverlapped=0x0) returned 1 [0138.036] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x980, lpOverlapped=0x0) returned 1 [0138.037] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.104] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.116] CloseHandle (hObject=0xf0) returned 1 [0138.116] CloseHandle (hObject=0xe8) returned 1 [0138.118] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.ozq0")) returned 0 [0138.118] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk.ozq0")) returned 0x20 [0138.118] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7ab5d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7ab5d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7ab5d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x270fb0, dwReserved1=0x18ebdc, cFileName="Skype for Business Recording Manager.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 0x26fd98 [0138.119] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7ab5d0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7ab5d0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7ab5d0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x270fb0, dwReserved1=0x18ebdc, cFileName="Skype for Business Recording Manager.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 0 [0138.119] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0138.119] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk")) returned 1 [0138.120] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Skype for Business Recording Manager.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\skype for business recording manager.lnk")) returned 0xffffffff [0138.120] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Spreadsheet Compare 2016.lnk", cAlternateFileName="SPREAD~1.LNK")) returned 1 [0138.120] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0138.121] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.122] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f6 [0138.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0138.123] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0138.173] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9f6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9f6, lpOverlapped=0x0) returned 1 [0138.178] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0138.179] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.235] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.247] CloseHandle (hObject=0xe8) returned 1 [0138.248] CloseHandle (hObject=0xf0) returned 1 [0138.250] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.ozq0")) returned 0 [0138.251] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk.ozq0")) returned 0x20 [0138.251] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x270f98, dwReserved1=0x18ebdc, cFileName="Spreadsheet Compare 2016.lnk", cAlternateFileName="SPREAD~1.LNK")) returned 0x26fd98 [0138.251] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9f6, dwReserved0=0x270f98, dwReserved1=0x18ebdc, cFileName="Spreadsheet Compare 2016.lnk", cAlternateFileName="SPREAD~1.LNK")) returned 0 [0138.251] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0138.251] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk")) returned 1 [0138.253] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Spreadsheet Compare 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\spreadsheet compare 2016.lnk")) returned 0xffffffff [0138.253] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9b1, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Telemetry Dashboard for Office 2016.lnk", cAlternateFileName="TELEME~1.LNK")) returned 1 [0138.253] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.254] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0138.256] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b1 [0138.256] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0138.256] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0138.319] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9b1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9b1, lpOverlapped=0x0) returned 1 [0138.336] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9c0, lpOverlapped=0x0) returned 1 [0138.337] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.402] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.415] CloseHandle (hObject=0xf0) returned 1 [0138.415] CloseHandle (hObject=0xe8) returned 1 [0138.417] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.ozq0")) returned 0 [0138.417] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk.ozq0")) returned 0x20 [0138.418] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9b1, dwReserved0=0x270fb0, dwReserved1=0x18ebdc, cFileName="Telemetry Dashboard for Office 2016.lnk", cAlternateFileName="TELEME~1.LNK")) returned 0x26fd98 [0138.418] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9b1, dwReserved0=0x270fb0, dwReserved1=0x18ebdc, cFileName="Telemetry Dashboard for Office 2016.lnk", cAlternateFileName="TELEME~1.LNK")) returned 0 [0138.418] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0138.418] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk")) returned 1 [0138.419] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Dashboard for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry dashboard for office 2016.lnk")) returned 0xffffffff [0138.419] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9f3, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 1 [0138.419] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0138.420] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.421] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f3 [0138.421] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0138.422] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0138.481] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9f3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9f3, lpOverlapped=0x0) returned 1 [0138.488] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0138.489] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.569] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.582] CloseHandle (hObject=0xe8) returned 1 [0138.582] CloseHandle (hObject=0xf0) returned 1 [0138.589] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.ozq0")) returned 0 [0138.590] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk.ozq0")) returned 0x20 [0138.590] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9f3, dwReserved0=0x270fa0, dwReserved1=0x18ebdc, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 0x26fd98 [0138.590] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9f3, dwReserved0=0x270fa0, dwReserved1=0x18ebdc, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 0 [0138.590] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0138.591] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk")) returned 1 [0138.592] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office 2016 Tools\\Telemetry Log for Office 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\microsoft office 2016 tools\\telemetry log for office 2016.lnk")) returned 0xffffffff [0138.592] FindNextFileA (in: hFindFile=0x26fe58, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7f7890, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad7f7890, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad7f7890, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x9f3, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Telemetry Log for Office 2016.lnk", cAlternateFileName="TELEME~2.LNK")) returned 0 [0138.593] FindClose (in: hFindFile=0x26fe58 | out: hFindFile=0x26fe58) returned 1 [0138.593] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad81d9f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad81d9f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad81d9f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x99f, dwReserved0=0x6620676f, dwReserved1=0x4f20726f, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0138.593] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0138.593] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.595] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x99f [0138.595] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0138.595] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0138.657] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x99f, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x99f, lpOverlapped=0x0) returned 1 [0138.658] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x9a0, lpOverlapped=0x0) returned 1 [0138.659] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.721] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.737] CloseHandle (hObject=0xf4) returned 1 [0138.738] CloseHandle (hObject=0xf0) returned 1 [0138.741] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.ozq0")) returned 0 [0138.742] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk.ozq0")) returned 0x20 [0138.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad81d9f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad81d9f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad81d9f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x99f, dwReserved0=0x26fe50, dwReserved1=0x18ee44, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 0x26fe48 [0138.742] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad81d9f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad81d9f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad81d9f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x99f, dwReserved0=0x26fe50, dwReserved1=0x18ee44, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 0 [0138.742] FindClose (in: hFindFile=0x26fe48 | out: hFindFile=0x26fe48) returned 1 [0138.743] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk")) returned 1 [0138.747] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneDrive for Business.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onedrive for business.lnk")) returned 0xffffffff [0138.747] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8b5f70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad8b5f70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad8b5f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 1 [0138.748] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.748] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0138.749] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x93c [0138.749] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0138.750] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0138.825] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x93c, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x93c, lpOverlapped=0x0) returned 1 [0138.826] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x940, lpOverlapped=0x0) returned 1 [0138.827] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0138.903] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0138.917] CloseHandle (hObject=0xf0) returned 1 [0138.917] CloseHandle (hObject=0xf4) returned 1 [0138.919] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.ozq0")) returned 0 [0138.919] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk.ozq0")) returned 0x20 [0138.919] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8b5f70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad8b5f70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad8b5f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 0x26fe38 [0138.919] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad8b5f70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad8b5f70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad8b5f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 0 [0138.920] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0138.920] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk")) returned 1 [0138.921] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\onenote 2016.lnk")) returned 0xffffffff [0138.921] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad928390, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad928390, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 1 [0138.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0138.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0138.923] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94a [0138.923] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0138.923] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0138.978] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x94a, lpOverlapped=0x0) returned 1 [0138.979] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x950, lpOverlapped=0x0) returned 1 [0138.980] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.051] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.063] CloseHandle (hObject=0xf4) returned 1 [0139.064] CloseHandle (hObject=0xf0) returned 1 [0139.066] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.ozq0")) returned 0 [0139.067] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk.ozq0")) returned 0x20 [0139.067] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad928390, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad928390, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 0x26fe38 [0139.067] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad928390, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad928390, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 0 [0139.067] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0139.067] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk")) returned 1 [0139.069] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\outlook 2016.lnk")) returned 0xffffffff [0139.069] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad928390, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad928390, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x975, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 1 [0139.069] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.069] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0139.070] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x975 [0139.070] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0139.071] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0139.120] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x975, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x975, lpOverlapped=0x0) returned 1 [0139.121] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x980, lpOverlapped=0x0) returned 1 [0139.122] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.188] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.204] CloseHandle (hObject=0xf0) returned 1 [0139.204] CloseHandle (hObject=0xf4) returned 1 [0139.227] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.ozq0")) returned 0 [0139.227] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk.ozq0")) returned 0x20 [0139.228] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad928390, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad928390, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x975, dwReserved0=0x26fe48, dwReserved1=0x18ee44, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 0x26fe40 [0139.228] FindNextFileA (in: hFindFile=0x26fe40, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad928390, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad928390, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x975, dwReserved0=0x26fe48, dwReserved1=0x18ee44, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 0 [0139.228] FindClose (in: hFindFile=0x26fe40 | out: hFindFile=0x26fe40) returned 1 [0139.228] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk")) returned 1 [0139.230] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\powerpoint 2016.lnk")) returned 0xffffffff [0139.230] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad94e4f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad94e4f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad94e4f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x944, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Publisher 2016.lnk", cAlternateFileName="PUBLIS~1.LNK")) returned 1 [0139.230] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0139.230] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.232] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x944 [0139.232] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0139.232] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0139.290] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x944, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x944, lpOverlapped=0x0) returned 1 [0139.291] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x950, lpOverlapped=0x0) returned 1 [0139.292] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.350] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.362] CloseHandle (hObject=0xf4) returned 1 [0139.362] CloseHandle (hObject=0xf0) returned 1 [0139.366] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.ozq0")) returned 0 [0139.366] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk.ozq0")) returned 0x20 [0139.366] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad94e4f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad94e4f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad94e4f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x944, dwReserved0=0x26fe48, dwReserved1=0x18ee44, cFileName="Publisher 2016.lnk", cAlternateFileName="PUBLIS~1.LNK")) returned 0x26fe38 [0139.367] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad94e4f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad94e4f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad94e4f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x944, dwReserved0=0x26fe48, dwReserved1=0x18ee44, cFileName="Publisher 2016.lnk", cAlternateFileName="PUBLIS~1.LNK")) returned 0 [0139.367] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0139.367] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk")) returned 1 [0139.368] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Publisher 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\publisher 2016.lnk")) returned 0xffffffff [0139.368] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0139.368] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.368] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0139.369] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x532 [0139.369] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0139.369] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0139.420] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x532, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x532, lpOverlapped=0x0) returned 1 [0139.421] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x540, lpOverlapped=0x0) returned 1 [0139.422] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.486] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.501] CloseHandle (hObject=0xf0) returned 1 [0139.501] CloseHandle (hObject=0xf4) returned 1 [0139.503] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.ozq0")) returned 0 [0139.503] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk.ozq0")) returned 0x20 [0139.504] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x26fe38, dwReserved1=0x18ee44, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 0x26fe30 [0139.504] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x26fe38, dwReserved1=0x18ee44, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 0 [0139.504] FindClose (in: hFindFile=0x26fe30 | out: hFindFile=0x26fe30) returned 1 [0139.504] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk")) returned 1 [0139.506] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Sidebar.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\sidebar.lnk")) returned 0xffffffff [0139.506] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad94e4f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad94e4f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad94e4f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Skype for Business 2016.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 1 [0139.506] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0139.506] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.507] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x97b [0139.507] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0139.507] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0139.558] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x97b, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x97b, lpOverlapped=0x0) returned 1 [0139.559] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x980, lpOverlapped=0x0) returned 1 [0139.560] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.618] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.630] CloseHandle (hObject=0xf4) returned 1 [0139.631] CloseHandle (hObject=0xf0) returned 1 [0139.761] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.ozq0")) returned 0 [0139.762] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk.ozq0")) returned 0x20 [0139.762] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad94e4f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad94e4f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad94e4f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="Skype for Business 2016.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 0x26fe50 [0139.763] FindNextFileA (in: hFindFile=0x26fe50, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad94e4f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad94e4f0, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad94e4f0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x97b, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="Skype for Business 2016.lnk", cAlternateFileName="SKYPEF~1.LNK")) returned 0 [0139.763] FindClose (in: hFindFile=0x26fe50 | out: hFindFile=0x26fe50) returned 1 [0139.763] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk")) returned 1 [0139.764] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Skype for Business 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\skype for business 2016.lnk")) returned 0xffffffff [0139.764] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Startup", cAlternateFileName="")) returned 1 [0139.764] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x26fd98, cFileName=".", cAlternateFileName="")) returned 0x26fe30 [0139.765] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x26fd98, cFileName="..", cAlternateFileName="")) returned 1 [0139.765] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xaa00a8, dwReserved1=0x26fd98, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.765] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0139.765] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0139.766] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0139.766] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0139.766] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0139.821] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xae, lpOverlapped=0x0) returned 1 [0139.822] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xb0, lpOverlapped=0x0) returned 1 [0139.823] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0139.879] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0139.891] CloseHandle (hObject=0xf4) returned 1 [0139.891] CloseHandle (hObject=0xe8) returned 1 [0139.893] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.ozq0")) returned 0 [0139.895] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.ozq0")) returned 0x20 [0139.895] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x270f28, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fd98 [0139.895] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x270f28, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0139.895] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0139.895] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0139.896] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0xffffffff [0139.897] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xaa00a8, dwReserved1=0x26fd98, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0139.897] FindClose (in: hFindFile=0x26fe30 | out: hFindFile=0x26fe30) returned 1 [0139.897] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0139.897] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fe30 [0139.897] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0139.898] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0139.898] FindClose (in: hFindFile=0x26fe30 | out: hFindFile=0x26fe30) returned 1 [0139.898] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0139.898] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0139.898] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0139.899] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x548 [0139.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0139.899] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0139.959] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x548, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x548, lpOverlapped=0x0) returned 1 [0139.959] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x550, lpOverlapped=0x0) returned 1 [0139.961] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.018] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.039] CloseHandle (hObject=0xf0) returned 1 [0140.039] CloseHandle (hObject=0xe8) returned 1 [0140.041] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.ozq0")) returned 0 [0140.041] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk.ozq0")) returned 0x20 [0140.041] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0x26fe50 [0140.041] FindNextFileA (in: hFindFile=0x26fe50, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0 [0140.041] FindClose (in: hFindFile=0x26fe50 | out: hFindFile=0x26fe50) returned 1 [0140.042] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk")) returned 1 [0140.043] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Anytime Upgrade.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows anytime upgrade.lnk")) returned 0xffffffff [0140.043] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0f58cc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0f58cc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0140.043] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0140.043] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.044] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52e [0140.044] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0140.045] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0140.095] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x52e, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x52e, lpOverlapped=0x0) returned 1 [0140.096] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x530, lpOverlapped=0x0) returned 1 [0140.098] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.167] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.180] CloseHandle (hObject=0xe8) returned 1 [0140.180] CloseHandle (hObject=0xf0) returned 1 [0140.182] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.ozq0")) returned 0 [0140.182] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk.ozq0")) returned 0x20 [0140.182] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0f58cc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0f58cc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x26fe48, dwReserved1=0x18ee44, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0x26fe40 [0140.183] FindNextFileA (in: hFindFile=0x26fe40, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0f58cc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xd0f58cc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xd0f58cc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x26fe48, dwReserved1=0x18ee44, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0 [0140.183] FindClose (in: hFindFile=0x26fe40 | out: hFindFile=0x26fe40) returned 1 [0140.183] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk")) returned 1 [0140.184] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows DVD Maker.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows dvd maker.lnk")) returned 0xffffffff [0140.184] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0140.185] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.185] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0140.186] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ba [0140.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0140.186] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0140.241] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ba, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4ba, lpOverlapped=0x0) returned 1 [0140.242] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4c0, lpOverlapped=0x0) returned 1 [0140.243] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.305] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.320] CloseHandle (hObject=0xf0) returned 1 [0140.320] CloseHandle (hObject=0xe8) returned 1 [0140.322] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.ozq0")) returned 0 [0140.323] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk.ozq0")) returned 0x20 [0140.323] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x26fe50, dwReserved1=0x18ee44, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x26fe48 [0140.323] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x26fe50, dwReserved1=0x18ee44, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0140.323] FindClose (in: hFindFile=0x26fe48 | out: hFindFile=0x26fe48) returned 1 [0140.323] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk")) returned 1 [0140.325] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows fax and scan.lnk")) returned 0xffffffff [0140.325] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0140.325] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0140.325] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.326] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60b [0140.326] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0140.326] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0140.381] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x60b, lpOverlapped=0x0) returned 1 [0140.382] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x610, lpOverlapped=0x0) returned 1 [0140.383] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.441] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.452] CloseHandle (hObject=0xe8) returned 1 [0140.453] CloseHandle (hObject=0xf0) returned 1 [0140.454] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.ozq0")) returned 0 [0140.455] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk.ozq0")) returned 0x20 [0140.456] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x26fe50, dwReserved1=0x18ee44, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x26fe48 [0140.456] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x26fe50, dwReserved1=0x18ee44, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0140.456] FindClose (in: hFindFile=0x26fe48 | out: hFindFile=0x26fe48) returned 1 [0140.456] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 1 [0140.457] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Media Player.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\windows media player.lnk")) returned 0xffffffff [0140.457] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad9c0910, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad9c0910, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 1 [0140.458] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.458] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0140.460] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x976 [0140.460] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0140.460] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0140.509] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x976, lpOverlapped=0x0) returned 1 [0140.533] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x980, lpOverlapped=0x0) returned 1 [0140.534] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.590] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.602] CloseHandle (hObject=0xf0) returned 1 [0140.602] CloseHandle (hObject=0xe8) returned 1 [0140.604] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.ozq0")) returned 0 [0140.604] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk.ozq0")) returned 0x20 [0140.605] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad9c0910, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad9c0910, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x26fe38, dwReserved1=0x18ee44, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0x26fe30 [0140.605] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad9c0910, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xad9c0910, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x26fe38, dwReserved1=0x18ee44, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0 [0140.605] FindClose (in: hFindFile=0x26fe30 | out: hFindFile=0x26fe30) returned 1 [0140.605] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk")) returned 1 [0140.606] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Word 2016.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\word 2016.lnk")) returned 0xffffffff [0140.606] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0140.607] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0140.607] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.608] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4de [0140.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0140.609] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0140.659] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4de, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4de, lpOverlapped=0x0) returned 1 [0140.660] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4e0, lpOverlapped=0x0) returned 1 [0140.661] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0140.720] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0140.733] CloseHandle (hObject=0xe8) returned 1 [0140.733] CloseHandle (hObject=0xf0) returned 1 [0140.933] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.ozq0")) returned 0 [0140.934] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk.ozq0")) returned 0x20 [0140.934] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0x26fe30 [0140.934] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x26fe40, dwReserved1=0x18ee44, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0140.934] FindClose (in: hFindFile=0x26fe30 | out: hFindFile=0x26fe30) returned 1 [0140.934] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk")) returned 1 [0140.936] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\programs\\xps viewer.lnk")) returned 0xffffffff [0140.936] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0140.936] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0140.937] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x506b6e6c, dwReserved1=0x6579616c, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0140.937] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0140.937] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0140.939] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f2 [0140.939] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0140.939] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0140.996] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f2, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x4f2, lpOverlapped=0x0) returned 1 [0140.998] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x500, lpOverlapped=0x0) returned 1 [0140.999] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.080] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.096] CloseHandle (hObject=0xe0) returned 1 [0141.096] CloseHandle (hObject=0xf0) returned 1 [0141.099] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk.ozq0")) returned 0 [0141.100] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk.ozq0")) returned 0x20 [0141.100] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x26ee28, dwReserved1=0x18f0ac, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x26dcd8 [0141.100] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x26ee28, dwReserved1=0x18f0ac, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0141.101] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0141.101] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk")) returned 1 [0141.103] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Windows Update.lnk" (normalized: "c:\\users\\all users\\microsoft\\windows\\start menu\\windows update.lnk")) returned 0xffffffff [0141.103] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x506b6e6c, dwReserved1=0x6579616c, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0141.103] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0141.104] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657461, dwReserved1=0x6e6b6e6c, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0141.104] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0141.104] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0141.104] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 0 [0141.104] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0141.104] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657461, dwReserved1=0x6e6b6e6c, cFileName="WER", cAlternateFileName="")) returned 1 [0141.104] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd40 [0141.105] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0141.105] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0141.105] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x26ed90, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0141.105] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 1 [0141.105] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 0 [0141.105] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0141.105] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0141.105] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x26ed90, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0141.119] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x26ed90, cFileName="..", cAlternateFileName="")) returned 1 [0141.120] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xb411bca0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb411bca0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb411bca0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x26ed90, cFileName="NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7", cAlternateFileName="NONCRI~2")) returned 1 [0141.120] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xb411bca0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb411bca0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb411bca0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe90 [0141.120] FindNextFileA (in: hFindFile=0x26fe90, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xb411bca0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb411bca0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb411bca0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0141.120] FindNextFileA (in: hFindFile=0x26fe90, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xb411bca0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb411bca0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb411bca0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="Report.wer", cAlternateFileName="")) returned 1 [0141.121] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\report.wer"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0141.121] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\report.wer.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0141.122] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x614 [0141.122] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0141.122] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0141.174] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x614, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x614, lpOverlapped=0x0) returned 1 [0141.176] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x620, lpOverlapped=0x0) returned 1 [0141.178] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.241] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.259] CloseHandle (hObject=0xe8) returned 1 [0141.259] CloseHandle (hObject=0xf4) returned 1 [0141.263] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\report.wer"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\report.wer.ozq0")) returned 0 [0141.263] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\report.wer.ozq0")) returned 0x820 [0141.263] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\Report.wer", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xb411bca0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb411bca0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb411bca0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x270ff0, dwReserved1=0x18ebdc, cFileName="Report.wer", cAlternateFileName="")) returned 0x26fd90 [0141.264] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xb411bca0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb411bca0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb411bca0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x270ff0, dwReserved1=0x18ebdc, cFileName="Report.wer", cAlternateFileName="")) returned 0 [0141.264] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0141.264] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\report.wer")) returned 1 [0141.265] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_14581a24ae3cd03160d66be822236893de867_cab_07347da7\\report.wer")) returned 0xffffffff [0141.265] FindNextFileA (in: hFindFile=0x26fe90, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xb411bca0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb411bca0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb411bca0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="Report.wer", cAlternateFileName="")) returned 0 [0141.265] FindClose (in: hFindFile=0x26fe90 | out: hFindFile=0x26fe90) returned 1 [0141.266] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xc13c57a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x26ed90, cFileName="NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400", cAlternateFileName="NONCRI~4")) returned 1 [0141.266] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xc13c57a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fe98 [0141.267] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xc13c57a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0141.267] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc13c57a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x77e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Report.wer", cAlternateFileName="")) returned 1 [0141.267] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\report.wer"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0141.267] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\report.wer.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0141.268] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77e [0141.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0141.268] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0141.337] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x77e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x77e, lpOverlapped=0x0) returned 1 [0141.339] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x780, lpOverlapped=0x0) returned 1 [0141.340] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.398] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.411] CloseHandle (hObject=0xf4) returned 1 [0141.411] CloseHandle (hObject=0xe8) returned 1 [0141.413] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\report.wer"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\report.wer.ozq0")) returned 0 [0141.413] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\report.wer.ozq0")) returned 0x820 [0141.413] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\Report.wer", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc13c57a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x77e, dwReserved0=0x271000, dwReserved1=0x18ebdc, cFileName="Report.wer", cAlternateFileName="")) returned 0x26fd90 [0141.413] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc13c57a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x77e, dwReserved0=0x271000, dwReserved1=0x18ebdc, cFileName="Report.wer", cAlternateFileName="")) returned 0 [0141.413] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0141.414] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\report.wer")) returned 1 [0141.415] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_6924e027c982b3b48a48ab43378a2d3de936f9f1_cab_06ecd400\\report.wer")) returned 0xffffffff [0141.415] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xc13c57a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x77e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Report.wer", cAlternateFileName="")) returned 0 [0141.415] FindClose (in: hFindFile=0x26fe98 | out: hFindFile=0x26fe98) returned 1 [0141.415] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb294e0a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x860084, dwReserved1=0x26ed90, cFileName="NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6", cAlternateFileName="NONCRI~1")) returned 1 [0141.415] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb294e0a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fe98 [0141.415] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb294e0a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0141.415] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2800, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb288f9c0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x1d64, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="DMI73A8.tmp.log.xml", cAlternateFileName="DMI73A~1.XML")) returned 1 [0141.415] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\DMI73A8.tmp.log.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\dmi73a8.tmp.log.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0141.416] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\DMI73A8.tmp.log.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\dmi73a8.tmp.log.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0141.431] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d64 [0141.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0141.431] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0141.499] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1d64, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1d64, lpOverlapped=0x0) returned 1 [0141.501] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1d70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d70, lpOverlapped=0x0) returned 1 [0141.502] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.564] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.575] CloseHandle (hObject=0xe8) returned 1 [0141.576] CloseHandle (hObject=0xf4) returned 1 [0141.577] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\DMI73A8.tmp.log.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\dmi73a8.tmp.log.xml"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\DMI73A8.tmp.log.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\dmi73a8.tmp.log.xml.ozq0")) returned 0 [0141.577] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\DMI73A8.tmp.log.xml.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\dmi73a8.tmp.log.xml.ozq0")) returned 0x820 [0141.577] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\DMI73A8.tmp.log.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2800, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb288f9c0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x1d64, dwReserved0=0x271010, dwReserved1=0x18ebdc, cFileName="DMI73A8.tmp.log.xml", cAlternateFileName="DMI73A~1.XML")) returned 0x26fd90 [0141.578] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2800, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb288f9c0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x1d64, dwReserved0=0x271010, dwReserved1=0x18ebdc, cFileName="DMI73A8.tmp.log.xml", cAlternateFileName="DMI73A~1.XML")) returned 0 [0141.578] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0141.578] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\DMI73A8.tmp.log.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\dmi73a8.tmp.log.xml")) returned 1 [0141.582] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\DMI73A8.tmp.log.xml" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\dmi73a8.tmp.log.xml")) returned 0xffffffff [0141.582] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb294e0a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Report.wer", cAlternateFileName="")) returned 1 [0141.582] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\report.wer"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0141.583] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\report.wer.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0141.583] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x816 [0141.583] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0141.583] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0141.642] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x816, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x816, lpOverlapped=0x0) returned 1 [0141.644] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x820, lpOverlapped=0x0) returned 1 [0141.646] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.705] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.718] CloseHandle (hObject=0xf4) returned 1 [0141.718] CloseHandle (hObject=0xe8) returned 1 [0141.720] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\report.wer"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\report.wer.ozq0")) returned 0 [0141.720] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\report.wer.ozq0")) returned 0x820 [0141.721] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\Report.wer", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb294e0a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x271000, dwReserved1=0x18ebdc, cFileName="Report.wer", cAlternateFileName="")) returned 0x26fd90 [0141.721] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb294e0a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x271000, dwReserved1=0x18ebdc, cFileName="Report.wer", cAlternateFileName="")) returned 0 [0141.721] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0141.721] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\report.wer")) returned 1 [0141.722] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_7ee33023ce28264d2338f4816fb96f7bae61c6a_cab_065c73f6\\report.wer")) returned 0xffffffff [0141.722] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xb294e0a0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xb294e0a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xb294e0a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Report.wer", cAlternateFileName="")) returned 0 [0141.722] FindClose (in: hFindFile=0x26fe98 | out: hFindFile=0x26fe98) returned 1 [0141.722] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xbfc69fc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbfc69fc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xbfc69fc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676f6c2e, dwReserved1=0x6c6d782e, cFileName="NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f", cAlternateFileName="NONCRI~3")) returned 1 [0141.722] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xbfc69fc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbfc69fc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xbfc69fc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fe98 [0141.723] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xbfc69fc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbfc69fc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xbfc69fc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0141.723] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xbfc69fc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbfc69fc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xbfc69fc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x77e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Report.wer", cAlternateFileName="")) returned 1 [0141.723] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\report.wer"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0141.723] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\report.wer.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0141.724] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x77e [0141.724] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0141.724] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0141.774] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x77e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x77e, lpOverlapped=0x0) returned 1 [0141.776] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x780, lpOverlapped=0x0) returned 1 [0141.777] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0141.838] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0141.851] CloseHandle (hObject=0xe8) returned 1 [0141.851] CloseHandle (hObject=0xf4) returned 1 [0141.852] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\report.wer"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\report.wer.ozq0")) returned 0 [0141.853] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\Report.wer.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\report.wer.ozq0")) returned 0x820 [0141.853] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\Report.wer", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xbfc69fc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbfc69fc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xbfc69fc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x77e, dwReserved0=0x271000, dwReserved1=0x18ebdc, cFileName="Report.wer", cAlternateFileName="")) returned 0x26fd90 [0141.853] FindNextFileA (in: hFindFile=0x26fd90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xbfc69fc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbfc69fc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xbfc69fc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x77e, dwReserved0=0x271000, dwReserved1=0x18ebdc, cFileName="Report.wer", cAlternateFileName="")) returned 0 [0141.853] FindClose (in: hFindFile=0x26fd90 | out: hFindFile=0x26fd90) returned 1 [0141.853] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\report.wer")) returned 1 [0141.854] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue\\NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\Report.wer" (normalized: "c:\\users\\all users\\microsoft\\windows\\wer\\reportqueue\\noncritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f\\report.wer")) returned 0xffffffff [0141.854] FindNextFileA (in: hFindFile=0x26fe98, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2820, ftCreationTime.dwLowDateTime=0xbfc69fc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbfc69fc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xbfc69fc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x77e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Report.wer", cAlternateFileName="")) returned 0 [0141.855] FindClose (in: hFindFile=0x26fe98 | out: hFindFile=0x26fe98) returned 1 [0141.855] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xbfc69fc0, ftCreationTime.dwHighDateTime=0x1d70554, ftLastAccessTime.dwLowDateTime=0xbfc69fc0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xbfc69fc0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x676f6c2e, dwReserved1=0x6c6d782e, cFileName="NonCritical_x64_b26fb5ddb583b426ae5e125aec3cdbd84fab752_cab_0724ca6f", cAlternateFileName="NONCRI~3")) returned 0 [0141.855] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0141.855] FindNextFileA (in: hFindFile=0x26dd40, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc13c57a0, ftLastAccessTime.dwHighDateTime=0x1d70554, ftLastWriteTime.dwLowDateTime=0xc13c57a0, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 0 [0141.855] FindClose (in: hFindFile=0x26dd40 | out: hFindFile=0x26dd40) returned 1 [0141.855] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e657461, dwReserved1=0x6e6b6e6c, cFileName="WER", cAlternateFileName="")) returned 0 [0141.855] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0141.855] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a4bec96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a4bec96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x636e6569, dwReserved1=0x69442079, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0141.855] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a4bec96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a4bec96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656576, dwReserved1=0x6e6b6e6c, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0141.902] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1a4bec96, ftLastAccessTime.dwHighDateTime=0x1cb892f, ftLastWriteTime.dwLowDateTime=0x1a4bec96, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656576, dwReserved1=0x6e6b6e6c, cFileName="..", cAlternateFileName="")) returned 1 [0141.902] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656576, dwReserved1=0x6e6b6e6c, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0141.902] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436785f, dwReserved1=0x3632625f, cFileName=".", cAlternateFileName="")) returned 0x26dd70 [0141.902] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fb3099, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436785f, dwReserved1=0x3632625f, cFileName="..", cAlternateFileName="")) returned 1 [0141.902] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436785f, dwReserved1=0x3632625f, cFileName="Backup", cAlternateFileName="")) returned 1 [0141.902] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Backup\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0141.903] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0141.903] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0141.903] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0141.903] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436785f, dwReserved1=0x3632625f, cFileName="Updates", cAlternateFileName="")) returned 1 [0141.903] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\Updates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0141.903] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0141.903] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0141.903] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0141.904] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436785f, dwReserved1=0x3632625f, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 1 [0141.904] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0141.904] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0141.904] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 1 [0141.904] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0141.904] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0141.917] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb17190 [0141.917] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0141.918] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0141.976] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0142.292] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0142.458] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0142.569] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0142.716] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x117190, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x117190, lpOverlapped=0x0) returned 1 [0142.755] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1171a0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x1171a0, lpOverlapped=0x0) returned 1 [0142.787] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0142.840] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0142.852] CloseHandle (hObject=0xe0) returned 1 [0142.852] CloseHandle (hObject=0xf4) returned 1 [0143.233] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm.ozq0")) returned 0 [0143.234] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm.ozq0")) returned 0x2020 [0143.234] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x26fec0, dwReserved1=0x18ee44, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 0x26dd18 [0143.234] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fd91f9, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fd91f9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x12c4d000, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0xb17190, dwReserved0=0x26fec0, dwReserved1=0x18ee44, cFileName="mpasbase.vdm", cAlternateFileName="")) returned 0 [0143.234] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0143.235] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm")) returned 1 [0143.236] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasbase.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasbase.vdm")) returned 0xffffffff [0143.236] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 1 [0143.237] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0143.237] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.238] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x52d90 [0143.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0143.238] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0143.303] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x52d90, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x52d90, lpOverlapped=0x0) returned 1 [0143.606] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x52da0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x52da0, lpOverlapped=0x0) returned 1 [0143.613] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0143.680] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0143.695] CloseHandle (hObject=0xf4) returned 1 [0143.696] CloseHandle (hObject=0xe0) returned 1 [0143.703] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm.ozq0")) returned 0 [0143.703] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm.ozq0")) returned 0x2020 [0143.704] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x26fec0, dwReserved1=0x18ee44, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 0x26dd18 [0143.704] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fff35a, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x6da22700, ftLastWriteTime.dwHighDateTime=0x1cb8783, nFileSizeHigh=0x0, nFileSizeLow=0x52d90, dwReserved0=0x26fec0, dwReserved1=0x18ee44, cFileName="mpasdlta.vdm", cAlternateFileName="")) returned 0 [0143.704] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0143.704] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm")) returned 1 [0143.709] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpasdlta.vdm" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpasdlta.vdm")) returned 0xffffffff [0143.709] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="mpengine.dll", cAlternateFileName="")) returned 1 [0143.709] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0143.710] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0143.710] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7d1d50 [0143.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0143.711] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0143.772] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0144.008] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0144.158] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2d1d50, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2d1d50, lpOverlapped=0x0) returned 1 [0144.213] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2d1d60, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2d1d60, lpOverlapped=0x0) returned 1 [0144.285] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.341] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.354] CloseHandle (hObject=0xe0) returned 1 [0144.354] CloseHandle (hObject=0xf4) returned 1 [0144.642] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll.ozq0")) returned 0 [0144.643] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll.ozq0")) returned 0x2020 [0144.643] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x26fec0, dwReserved1=0x18ee44, cFileName="mpengine.dll", cAlternateFileName="")) returned 0x26dd18 [0144.643] FindNextFileA (in: hFindFile=0x26dd18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x26fec0, dwReserved1=0x18ee44, cFileName="mpengine.dll", cAlternateFileName="")) returned 0 [0144.643] FindClose (in: hFindFile=0x26dd18 | out: hFindFile=0x26dd18) returned 1 [0144.643] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll")) returned 1 [0144.657] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Definition Updates\\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\\mpengine.dll" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\definition updates\\{d2b0b133-42ed-44d3-809a-46ebb62ba863}\\mpengine.dll")) returned 0xffffffff [0144.657] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fb3099, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x93b6800, ftLastWriteTime.dwHighDateTime=0x1cb85c9, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d50, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="mpengine.dll", cAlternateFileName="")) returned 0 [0144.657] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0144.658] FindNextFileA (in: hFindFile=0x26dd70, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1fb3099, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x1fff35a, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x1fff35a, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436785f, dwReserved1=0x3632625f, cFileName="{D2B0B133-42ED-44D3-809A-46EBB62BA863}", cAlternateFileName="{D2B0B~1")) returned 0 [0144.658] FindClose (in: hFindFile=0x26dd70 | out: hFindFile=0x26dd70) returned 1 [0144.658] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0144.658] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\LocalCopy\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0144.658] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName="..", cAlternateFileName="")) returned 1 [0144.658] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName="..", cAlternateFileName="")) returned 0 [0144.658] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0144.659] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0144.659] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Quarantine\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName=".", cAlternateFileName="")) returned 0x26dd60 [0144.659] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName="..", cAlternateFileName="")) returned 1 [0144.659] FindNextFileA (in: hFindFile=0x26dd60, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName="..", cAlternateFileName="")) returned 0 [0144.659] FindClose (in: hFindFile=0x26dd60 | out: hFindFile=0x26dd60) returned 1 [0144.659] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="Scans", cAlternateFileName="")) returned 1 [0144.659] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName=".", cAlternateFileName="")) returned 0x26dd50 [0144.660] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7690f9e4, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7690f9e4, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName="..", cAlternateFileName="")) returned 1 [0144.660] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName="History", cAlternateFileName="")) returned 1 [0144.660] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0144.660] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0144.660] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="CacheManager", cAlternateFileName="CACHEM~1")) returned 1 [0144.660] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\CacheManager\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe48 [0144.661] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0144.661] FindNextFileA (in: hFindFile=0x26fe48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x76b24d28, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76b24d28, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76b24d28, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0144.661] FindClose (in: hFindFile=0x26fe48 | out: hFindFile=0x26fe48) returned 1 [0144.661] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Results", cAlternateFileName="")) returned 1 [0144.661] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Results\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe38 [0144.661] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0144.661] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0144.661] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0144.661] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Service", cAlternateFileName="")) returned 1 [0144.661] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Service\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe38 [0144.662] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0144.662] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ce0c6, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x769ce0c6, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x769ce0c6, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0144.662] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0144.662] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Store", cAlternateFileName="")) returned 1 [0144.662] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Scans\\History\\Store\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe38 [0144.662] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0144.662] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0144.662] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0144.663] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x244fb42, ftCreationTime.dwHighDateTime=0x1cb892c, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Store", cAlternateFileName="")) returned 0 [0144.663] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0144.663] FindNextFileA (in: hFindFile=0x26dd50, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7690f9e4, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x244fb42, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x244fb42, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3436786c, dwReserved1=0x3632625f, cFileName="History", cAlternateFileName="")) returned 0 [0144.663] FindClose (in: hFindFile=0x26dd50 | out: hFindFile=0x26dd50) returned 1 [0144.663] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="Support", cAlternateFileName="")) returned 1 [0144.663] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34367872, dwReserved1=0x3632625f, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0144.663] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34367872, dwReserved1=0x3632625f, cFileName="..", cAlternateFileName="")) returned 1 [0144.663] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x188be520, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x1fbc, dwReserved0=0x34367872, dwReserved1=0x3632625f, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 1 [0144.663] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0144.664] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0144.664] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1fbc [0144.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0144.665] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0144.726] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1fbc, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1fbc, lpOverlapped=0x0) returned 1 [0144.729] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1fc0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1fc0, lpOverlapped=0x0) returned 1 [0144.731] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0144.789] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0144.802] CloseHandle (hObject=0xf0) returned 1 [0144.802] CloseHandle (hObject=0xf4) returned 1 [0144.911] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log.ozq0")) returned 0 [0144.912] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log.ozq0")) returned 0x2020 [0144.912] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x188be520, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x1fbc, dwReserved0=0x26edd8, dwReserved1=0x18f0ac, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 0x26edc8 [0144.913] FindNextFileA (in: hFindFile=0x26edc8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x188be520, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x1fbc, dwReserved0=0x26edd8, dwReserved1=0x18f0ac, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 0 [0144.913] FindClose (in: hFindFile=0x26edc8 | out: hFindFile=0x26edc8) returned 1 [0144.913] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log")) returned 1 [0144.915] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows Defender\\Support\\MPLog-07132009-221054.log" (normalized: "c:\\users\\all users\\microsoft\\windows defender\\support\\mplog-07132009-221054.log")) returned 0xffffffff [0144.915] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76792c22, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x188be520, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x1fbc, dwReserved0=0x34367872, dwReserved1=0x3632625f, cFileName="MPLog-07132009-221054.log", cAlternateFileName="MPLOG-~1.LOG")) returned 0 [0144.915] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0144.916] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x76792c22, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x76792c22, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d444532, dwReserved1=0x33443434, cFileName="Support", cAlternateFileName="")) returned 0 [0144.916] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0144.916] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0144.916] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d393030, dwReserved1=0x30313232, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0144.916] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d393030, dwReserved1=0x30313232, cFileName="..", cAlternateFileName="")) returned 1 [0144.917] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d393030, dwReserved1=0x30313232, cFileName="MSFax", cAlternateFileName="")) returned 1 [0144.917] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0144.918] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0144.919] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1 [0144.919] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\ActivityLog\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0144.919] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0144.919] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0144.919] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0144.919] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Common Coverpages", cAlternateFileName="COMMON~1")) returned 1 [0144.920] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0144.920] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0144.920] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="en-US", cAlternateFileName="")) returned 1 [0144.920] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fe38 [0144.921] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0144.921] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="confident.cov", cAlternateFileName="")) returned 1 [0144.921] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0144.922] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0144.923] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28aa [0144.923] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0144.924] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0144.974] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x28aa, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x28aa, lpOverlapped=0x0) returned 1 [0144.976] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x28b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x28b0, lpOverlapped=0x0) returned 1 [0144.977] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.035] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.048] CloseHandle (hObject=0xe0) returned 1 [0145.048] CloseHandle (hObject=0xe8) returned 1 [0145.050] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov.ozq0")) returned 0 [0145.051] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov.ozq0")) returned 0x2020 [0145.051] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="confident.cov", cAlternateFileName="")) returned 0x26fd98 [0145.051] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x28aa, dwReserved0=0x270f40, dwReserved1=0x18ebdc, cFileName="confident.cov", cAlternateFileName="")) returned 0 [0145.051] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0145.051] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov")) returned 0 [0145.052] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\confident.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\confident.cov")) returned 0x20 [0145.052] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fyi.cov", cAlternateFileName="")) returned 1 [0145.052] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0145.052] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.056] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a09 [0145.056] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0145.057] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0145.125] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2a09, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2a09, lpOverlapped=0x0) returned 1 [0145.129] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2a10, lpOverlapped=0x0) returned 1 [0145.130] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.190] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.202] CloseHandle (hObject=0xe8) returned 1 [0145.202] CloseHandle (hObject=0xe0) returned 1 [0145.204] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov.ozq0")) returned 0 [0145.204] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov.ozq0")) returned 0x2020 [0145.204] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x270f30, dwReserved1=0x18ebdc, cFileName="fyi.cov", cAlternateFileName="")) returned 0x26fd98 [0145.205] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2a09, dwReserved0=0x270f30, dwReserved1=0x18ebdc, cFileName="fyi.cov", cAlternateFileName="")) returned 0 [0145.205] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0145.205] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov")) returned 0 [0145.205] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\fyi.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\fyi.cov")) returned 0x20 [0145.206] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="generic.cov", cAlternateFileName="")) returned 1 [0145.206] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.206] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0145.207] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3aa0 [0145.207] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0145.207] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0145.268] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3aa0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3aa0, lpOverlapped=0x0) returned 1 [0145.412] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3ab0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3ab0, lpOverlapped=0x0) returned 1 [0145.414] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.477] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.492] CloseHandle (hObject=0xe0) returned 1 [0145.493] CloseHandle (hObject=0xe8) returned 1 [0145.495] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov.ozq0")) returned 0 [0145.495] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov.ozq0")) returned 0x2020 [0145.495] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="generic.cov", cAlternateFileName="")) returned 0x26fd98 [0145.496] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3aa0, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="generic.cov", cAlternateFileName="")) returned 0 [0145.496] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0145.496] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov")) returned 0 [0145.496] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\generic.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\generic.cov")) returned 0x20 [0145.497] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="urgent.cov", cAlternateFileName="")) returned 1 [0145.497] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0145.497] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.498] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2886 [0145.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0145.498] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0145.563] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2886, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2886, lpOverlapped=0x0) returned 1 [0145.594] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2890, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2890, lpOverlapped=0x0) returned 1 [0145.595] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.669] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.681] CloseHandle (hObject=0xe8) returned 1 [0145.681] CloseHandle (hObject=0xe0) returned 1 [0145.682] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov.ozq0")) returned 0 [0145.683] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov.ozq0")) returned 0x2020 [0145.683] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="urgent.cov", cAlternateFileName="")) returned 0x26fd98 [0145.683] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x270f38, dwReserved1=0x18ebdc, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0145.683] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0145.683] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov")) returned 0 [0145.683] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Common Coverpages\\en-US\\urgent.cov" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\common coverpages\\en-us\\urgent.cov")) returned 0x20 [0145.683] FindNextFileA (in: hFindFile=0x26fe38, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2886, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="urgent.cov", cAlternateFileName="")) returned 0 [0145.683] FindClose (in: hFindFile=0x26fe38 | out: hFindFile=0x26fe38) returned 1 [0145.684] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="en-US", cAlternateFileName="")) returned 0 [0145.684] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0145.684] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Inbox", cAlternateFileName="")) returned 1 [0145.684] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Inbox\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0145.684] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0145.684] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0145.684] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0145.684] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Queue", cAlternateFileName="")) returned 1 [0145.684] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\Queue\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0145.685] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0145.685] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0145.685] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0145.685] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="SentItems", cAlternateFileName="SENTIT~1")) returned 1 [0145.685] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\SentItems\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0145.685] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0145.685] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0145.685] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0145.685] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 1 [0145.685] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dcd8 [0145.686] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0145.686] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="en-US", cAlternateFileName="")) returned 1 [0145.686] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fe30 [0145.686] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0145.686] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 1 [0145.686] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0145.686] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0145.687] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15dbe [0145.687] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0145.687] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0145.760] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x15dbe, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x15dbe, lpOverlapped=0x0) returned 1 [0145.797] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x15dc0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x15dc0, lpOverlapped=0x0) returned 1 [0145.799] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0145.866] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0145.881] CloseHandle (hObject=0xe0) returned 1 [0145.881] CloseHandle (hObject=0xe8) returned 1 [0145.884] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif.ozq0")) returned 0 [0145.885] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif.ozq0")) returned 0x2020 [0145.885] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x270f30, dwReserved1=0x18ebdc, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0x26fd98 [0145.886] FindNextFileA (in: hFindFile=0x26fd98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x270f30, dwReserved1=0x18ebdc, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0145.886] FindClose (in: hFindFile=0x26fd98 | out: hFindFile=0x26fd98) returned 1 [0145.886] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif")) returned 0 [0145.886] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax\\VirtualInbox\\en-US\\WelcomeFax.tif" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msfax\\virtualinbox\\en-us\\welcomefax.tif")) returned 0x20 [0145.886] FindNextFileA (in: hFindFile=0x26fe30, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe3998d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x10b3266c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfe3998d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15dbe, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WelcomeFax.tif", cAlternateFileName="")) returned 0 [0145.886] FindClose (in: hFindFile=0x26fe30 | out: hFindFile=0x26fe30) returned 1 [0145.886] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x21cf2d38, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18766f, dwReserved1=0x76f73c74, cFileName="en-US", cAlternateFileName="")) returned 0 [0145.886] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0145.886] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="VirtualInbox", cAlternateFileName="VIRTUA~1")) returned 0 [0145.887] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0145.887] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67617078, dwReserved1=0x30317365, cFileName="MSScan", cAlternateFileName="")) returned 1 [0145.887] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0145.887] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0145.887] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0145.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0145.887] CreateFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0145.888] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7e148 [0145.888] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0145.888] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0145.934] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7e148, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x7e148, lpOverlapped=0x0) returned 1 [0145.949] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7e150, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x7e150, lpOverlapped=0x0) returned 1 [0145.958] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.019] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.031] CloseHandle (hObject=0xf4) returned 1 [0146.031] CloseHandle (hObject=0xf0) returned 1 [0146.037] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), lpNewFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.ozq0")) returned 0 [0146.038] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg.ozq0" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg.ozq0")) returned 0x2020 [0146.038] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0x26dcd8 [0146.038] FindNextFileA (in: hFindFile=0x26dcd8, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x26ee20, dwReserved1=0x18f0ac, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0146.038] FindClose (in: hFindFile=0x26dcd8 | out: hFindFile=0x26dcd8) returned 1 [0146.039] DeleteFileA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0 [0146.039] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\users\\all users\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0146.039] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0146.039] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0146.039] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67617078, dwReserved1=0x30317365, cFileName="MSScan", cAlternateFileName="")) returned 0 [0146.039] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0146.039] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0146.039] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0146.040] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0146.040] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="Profiles", cAlternateFileName="")) returned 1 [0146.040] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0146.040] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0146.040] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 0 [0146.040] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0146.041] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="Profiles", cAlternateFileName="")) returned 0 [0146.041] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0146.041] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0146.041] FindClose (in: hFindFile=0x26bc88 | out: hFindFile=0x26bc88) returned 1 [0146.041] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65646e65, dwReserved1=0x72757472, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0146.041] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName=".", cAlternateFileName="")) returned 0x26bc98 [0146.042] FindNextFileA (in: hFindFile=0x26bc98, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="..", cAlternateFileName="")) returned 1 [0146.042] FindNextFileA (in: hFindFile=0x26bc98, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="setup", cAlternateFileName="")) returned 1 [0146.042] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Microsoft OneDrive\\setup\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0146.042] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0146.042] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 0 [0146.042] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0146.042] FindNextFileA (in: hFindFile=0x26bc98, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="setup", cAlternateFileName="")) returned 0 [0146.042] FindClose (in: hFindFile=0x26bc98 | out: hFindFile=0x26bc98) returned 1 [0146.042] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xb3a789d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3a789d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65646e65, dwReserved1=0x72757472, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0146.043] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xb3a789d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3a789d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName=".", cAlternateFileName="")) returned 0x26bc90 [0146.044] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0xb3a789d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3a789d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="..", cAlternateFileName="")) returned 1 [0146.044] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322ba670, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0146.044] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322ba670, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0146.045] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322ba670, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0146.045] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 1 [0146.045] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd98 [0146.045] FindNextFileA (in: hFindFile=0x26dd98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0146.045] FindNextFileA (in: hFindFile=0x26dd98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="Patch", cAlternateFileName="")) returned 1 [0146.045] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0146.046] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0146.046] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="x64", cAlternateFileName="")) returned 1 [0146.046] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd20 [0146.046] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0146.046] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7584c900, ftCreationTime.dwHighDateTime=0x1d0a14b, ftLastAccessTime.dwLowDateTime=0x7584c900, ftLastAccessTime.dwHighDateTime=0x1d0a14b, ftLastWriteTime.dwLowDateTime=0x7584c900, ftLastWriteTime.dwHighDateTime=0x1d0a14b, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0146.046] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0146.047] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.ozq0" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.047] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf7139 [0146.047] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0146.048] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0146.108] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf7139, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xf7139, lpOverlapped=0x0) returned 1 [0146.128] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf7140, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf7140, lpOverlapped=0x0) returned 1 [0146.148] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.202] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.215] CloseHandle (hObject=0xe8) returned 1 [0146.216] CloseHandle (hObject=0xe0) returned 1 [0146.232] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.ozq0" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.ozq0")) returned 0 [0146.233] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.ozq0" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.ozq0")) returned 0x20 [0146.233] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7584c900, ftCreationTime.dwHighDateTime=0x1d0a14b, ftLastAccessTime.dwLowDateTime=0x7584c900, ftLastAccessTime.dwHighDateTime=0x1d0a14b, ftLastWriteTime.dwLowDateTime=0x7584c900, ftLastWriteTime.dwHighDateTime=0x1d0a14b, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0x270ef0 [0146.233] FindNextFileA (in: hFindFile=0x270ef0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7584c900, ftCreationTime.dwHighDateTime=0x1d0a14b, ftLastAccessTime.dwLowDateTime=0x7584c900, ftLastAccessTime.dwHighDateTime=0x1d0a14b, ftLastWriteTime.dwLowDateTime=0x7584c900, ftLastWriteTime.dwHighDateTime=0x1d0a14b, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0146.234] FindClose (in: hFindFile=0x270ef0 | out: hFindFile=0x270ef0) returned 1 [0146.234] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu")) returned 1 [0146.245] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu")) returned 0xffffffff [0146.245] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7584c900, ftCreationTime.dwHighDateTime=0x1d0a14b, ftLastAccessTime.dwLowDateTime=0x7584c900, ftLastAccessTime.dwHighDateTime=0x1d0a14b, ftLastWriteTime.dwLowDateTime=0x7584c900, ftLastWriteTime.dwHighDateTime=0x1d0a14b, nFileSizeHigh=0x0, nFileSizeLow=0xf7139, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0146.245] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0146.246] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="x64", cAlternateFileName="")) returned 0 [0146.246] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0146.246] FindNextFileA (in: hFindFile=0x26dd98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="Patch", cAlternateFileName="")) returned 0 [0146.246] FindClose (in: hFindFile=0x26dd98 | out: hFindFile=0x26dd98) returned 1 [0146.246] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x322e07d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x322e07d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x322e07d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 0 [0146.246] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0146.246] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56db4070, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0146.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56db4070, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0146.247] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56db4070, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0146.247] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 1 [0146.247] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd98 [0146.248] FindNextFileA (in: hFindFile=0x26dd98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0146.248] FindNextFileA (in: hFindFile=0x26dd98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="Patch", cAlternateFileName="")) returned 1 [0146.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0146.248] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0146.248] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="x64", cAlternateFileName="")) returned 1 [0146.248] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd20 [0146.249] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0146.249] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972dc300, ftCreationTime.dwHighDateTime=0x1d287fd, ftLastAccessTime.dwLowDateTime=0x972dc300, ftLastAccessTime.dwHighDateTime=0x1d287fd, ftLastWriteTime.dwLowDateTime=0x972dc300, ftLastWriteTime.dwHighDateTime=0x1d287fd, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0146.249] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0146.249] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.ozq0" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0146.250] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc93c [0146.250] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0146.250] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0146.307] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xfc93c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xfc93c, lpOverlapped=0x0) returned 1 [0146.324] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xfc940, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xfc940, lpOverlapped=0x0) returned 1 [0146.345] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.412] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.428] CloseHandle (hObject=0xe0) returned 1 [0146.429] CloseHandle (hObject=0xe8) returned 1 [0146.463] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.ozq0" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.ozq0")) returned 0 [0146.464] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu.ozq0" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu.ozq0")) returned 0x20 [0146.464] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972dc300, ftCreationTime.dwHighDateTime=0x1d287fd, ftLastAccessTime.dwLowDateTime=0x972dc300, ftLastAccessTime.dwHighDateTime=0x1d287fd, ftLastWriteTime.dwLowDateTime=0x972dc300, ftLastWriteTime.dwHighDateTime=0x1d287fd, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0x270ef0 [0146.464] FindNextFileA (in: hFindFile=0x270ef0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972dc300, ftCreationTime.dwHighDateTime=0x1d287fd, ftLastAccessTime.dwLowDateTime=0x972dc300, ftLastAccessTime.dwHighDateTime=0x1d287fd, ftLastWriteTime.dwLowDateTime=0x972dc300, ftLastWriteTime.dwHighDateTime=0x1d287fd, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0146.464] FindClose (in: hFindFile=0x270ef0 | out: hFindFile=0x270ef0) returned 1 [0146.465] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu")) returned 1 [0146.477] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\windows6.1-kb2999226-x64.msu")) returned 0xffffffff [0146.477] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972dc300, ftCreationTime.dwHighDateTime=0x1d287fd, ftLastAccessTime.dwLowDateTime=0x972dc300, ftLastAccessTime.dwHighDateTime=0x1d287fd, ftLastWriteTime.dwLowDateTime=0x972dc300, ftLastWriteTime.dwHighDateTime=0x1d287fd, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0146.477] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0146.478] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="x64", cAlternateFileName="")) returned 0 [0146.478] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0146.478] FindNextFileA (in: hFindFile=0x26dd98, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="Patch", cAlternateFileName="")) returned 0 [0146.478] FindClose (in: hFindFile=0x26dd98 | out: hFindFile=0x26dd98) returned 1 [0146.482] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56e00330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x56e00330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x56e00330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 0 [0146.482] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0146.482] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508", cAlternateFileName="{0FA68~1.285")) returned 1 [0146.482] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0146.483] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="..", cAlternateFileName="")) returned 1 [0146.483] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 1 [0146.483] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ddb0 [0146.483] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0146.483] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93dbc490, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93dbc490, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0146.483] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93dbc490, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93dbc490, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0146.483] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93dbc490, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93dbc490, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0146.484] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b027600, ftCreationTime.dwHighDateTime=0x1d5c5bb, ftLastAccessTime.dwLowDateTime=0x1b027600, ftLastAccessTime.dwHighDateTime=0x1d5c5bb, ftLastWriteTime.dwLowDateTime=0x1b027600, ftLastWriteTime.dwHighDateTime=0x1d5c5bb, nFileSizeHigh=0x0, nFileSizeLow=0x4f83ae, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0146.484] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0146.484] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0146.487] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f83ae [0146.487] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0146.488] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0146.546] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f83ae, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4f83ae, lpOverlapped=0x0) returned 1 [0146.720] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f83b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4f83b0, lpOverlapped=0x0) returned 1 [0146.889] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0146.950] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0146.965] CloseHandle (hObject=0xf4) returned 1 [0146.966] CloseHandle (hObject=0xe8) returned 1 [0147.159] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0")) returned 0 [0147.160] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0")) returned 0x20 [0147.160] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b027600, ftCreationTime.dwHighDateTime=0x1d5c5bb, ftLastAccessTime.dwLowDateTime=0x1b027600, ftLastAccessTime.dwHighDateTime=0x1d5c5bb, ftLastWriteTime.dwLowDateTime=0x1b027600, ftLastWriteTime.dwHighDateTime=0x1d5c5bb, nFileSizeHigh=0x0, nFileSizeLow=0x4f83ae, dwReserved0=0x26ff10, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0147.160] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b027600, ftCreationTime.dwHighDateTime=0x1d5c5bb, ftLastAccessTime.dwLowDateTime=0x1b027600, ftLastAccessTime.dwHighDateTime=0x1d5c5bb, ftLastWriteTime.dwLowDateTime=0x1b027600, ftLastWriteTime.dwHighDateTime=0x1d5c5bb, nFileSizeHigh=0x0, nFileSizeLow=0x4f83ae, dwReserved0=0x26ff10, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0147.160] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0147.160] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0147.171] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0147.172] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4be2ab00, ftCreationTime.dwHighDateTime=0x1d5c5bb, ftLastAccessTime.dwLowDateTime=0x4be2ab00, ftLastAccessTime.dwHighDateTime=0x1d5c5bb, ftLastWriteTime.dwLowDateTime=0x4be2ab00, ftLastWriteTime.dwHighDateTime=0x1d5c5bb, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0147.172] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0147.172] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0147.173] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d000 [0147.173] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0147.173] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0147.228] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2d000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2d000, lpOverlapped=0x0) returned 1 [0147.232] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2d010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2d010, lpOverlapped=0x0) returned 1 [0147.235] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.292] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.306] CloseHandle (hObject=0xe8) returned 1 [0147.306] CloseHandle (hObject=0xf4) returned 1 [0147.310] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0")) returned 0 [0147.310] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0")) returned 0x20 [0147.311] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4be2ab00, ftCreationTime.dwHighDateTime=0x1d5c5bb, ftLastAccessTime.dwLowDateTime=0x4be2ab00, ftLastAccessTime.dwHighDateTime=0x1d5c5bb, ftLastWriteTime.dwLowDateTime=0x4be2ab00, ftLastWriteTime.dwHighDateTime=0x1d5c5bb, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x26ff38, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0147.311] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4be2ab00, ftCreationTime.dwHighDateTime=0x1d5c5bb, ftLastAccessTime.dwLowDateTime=0x4be2ab00, ftLastAccessTime.dwHighDateTime=0x1d5c5bb, ftLastWriteTime.dwLowDateTime=0x4be2ab00, ftLastWriteTime.dwHighDateTime=0x1d5c5bb, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x26ff38, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0147.311] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0147.311] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0147.313] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{0FA68574-690B-4B00-89AA-B28946231449}v14.25.28508\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{0fa68574-690b-4b00-89aa-b28946231449}v14.25.28508\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0147.313] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4be2ab00, ftCreationTime.dwHighDateTime=0x1d5c5bb, ftLastAccessTime.dwLowDateTime=0x4be2ab00, ftLastAccessTime.dwHighDateTime=0x1d5c5bb, ftLastWriteTime.dwLowDateTime=0x4be2ab00, ftLastWriteTime.dwHighDateTime=0x1d5c5bb, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0147.313] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0147.314] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93dbc490, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93dbc490, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f03c, dwReserved1=0x76f73c74, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0147.314] FindClose (in: hFindFile=0x26ddb0 | out: hFindFile=0x26ddb0) returned 1 [0147.314] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67706a2e, dwReserved1=0x30317365, cFileName="packages", cAlternateFileName="")) returned 0 [0147.314] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0147.314] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bf7de30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c0163b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c0163b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0147.314] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bf7de30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c0163b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c0163b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0147.314] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bf7de30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c0163b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c0163b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0147.315] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c0163b0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c1b92d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c1b92d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0147.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c0163b0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c1b92d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c1b92d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x26dda8 [0147.315] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c0163b0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c1b92d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c1b92d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0147.315] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1b92d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c22b6f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c22b6f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0147.315] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1b92d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c22b6f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c22b6f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0147.315] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1b92d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c22b6f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c22b6f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0147.315] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b40d00, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc0b40d00, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc0b40d00, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0147.315] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0147.316] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0147.318] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf36be [0147.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0147.319] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0147.374] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf36be, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xf36be, lpOverlapped=0x0) returned 1 [0147.391] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf36c0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xf36c0, lpOverlapped=0x0) returned 1 [0147.414] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.480] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.511] CloseHandle (hObject=0xf4) returned 1 [0147.511] CloseHandle (hObject=0xe8) returned 1 [0147.558] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0")) returned 0 [0147.558] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0")) returned 0x20 [0147.558] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b40d00, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc0b40d00, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc0b40d00, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x26ff00, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0147.592] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b40d00, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc0b40d00, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc0b40d00, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0xf36be, dwReserved0=0x26ff00, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0147.609] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0147.609] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0147.619] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0147.619] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b40d00, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc0b40d00, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc0b40d00, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0147.619] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0147.620] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0147.620] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0147.621] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0147.621] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0147.852] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x23000, lpOverlapped=0x0) returned 1 [0147.859] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x23010, lpOverlapped=0x0) returned 1 [0147.864] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0147.942] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0147.957] CloseHandle (hObject=0xe8) returned 1 [0147.957] CloseHandle (hObject=0xf4) returned 1 [0147.960] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0")) returned 0 [0147.961] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0")) returned 0x20 [0147.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b40d00, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc0b40d00, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc0b40d00, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x26ff20, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0147.962] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b40d00, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc0b40d00, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc0b40d00, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x26ff20, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0147.962] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0147.962] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0147.964] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0147.965] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0b40d00, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc0b40d00, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc0b40d00, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0147.965] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0147.965] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c1b92d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c22b6f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c22b6f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0147.965] FindClose (in: hFindFile=0x26dda8 | out: hFindFile=0x26dda8) returned 1 [0147.965] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c0163b0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c1b92d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c1b92d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0147.965] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0147.965] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d701d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508", cAlternateFileName="{2BC3B~1.285")) returned 1 [0147.965] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d701d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0147.966] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d701d0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="..", cAlternateFileName="")) returned 1 [0147.966] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0147.966] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x26ddb0 [0147.966] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0147.966] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0147.967] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0147.967] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0147.967] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21afe00, ftCreationTime.dwHighDateTime=0x1d5c5ba, ftLastAccessTime.dwLowDateTime=0xb21afe00, ftLastAccessTime.dwHighDateTime=0x1d5c5ba, ftLastWriteTime.dwLowDateTime=0xb21afe00, ftLastWriteTime.dwHighDateTime=0x1d5c5ba, nFileSizeHigh=0x0, nFileSizeLow=0x14de75, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0147.967] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0147.967] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0147.972] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14de75 [0147.972] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0147.972] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0148.030] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x14de75, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x14de75, lpOverlapped=0x0) returned 1 [0148.073] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x14de80, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x14de80, lpOverlapped=0x0) returned 1 [0148.110] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.182] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.204] CloseHandle (hObject=0xf4) returned 1 [0148.204] CloseHandle (hObject=0xe8) returned 1 [0148.224] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0")) returned 0 [0148.224] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0")) returned 0x20 [0148.224] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21afe00, ftCreationTime.dwHighDateTime=0x1d5c5ba, ftLastAccessTime.dwLowDateTime=0xb21afe00, ftLastAccessTime.dwHighDateTime=0x1d5c5ba, ftLastWriteTime.dwLowDateTime=0xb21afe00, ftLastWriteTime.dwHighDateTime=0x1d5c5ba, nFileSizeHigh=0x0, nFileSizeLow=0x14de75, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0148.225] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb21afe00, ftCreationTime.dwHighDateTime=0x1d5c5ba, ftLastAccessTime.dwLowDateTime=0xb21afe00, ftLastAccessTime.dwHighDateTime=0x1d5c5ba, ftLastWriteTime.dwLowDateTime=0xb21afe00, ftLastWriteTime.dwHighDateTime=0x1d5c5ba, nFileSizeHigh=0x0, nFileSizeLow=0x14de75, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0148.225] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0148.225] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0148.229] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0148.229] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec849b00, ftCreationTime.dwHighDateTime=0x1d5c5ba, ftLastAccessTime.dwLowDateTime=0xec849b00, ftLastAccessTime.dwHighDateTime=0x1d5c5ba, ftLastWriteTime.dwLowDateTime=0xec849b00, ftLastWriteTime.dwHighDateTime=0x1d5c5ba, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0148.230] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0148.230] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0148.231] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f000 [0148.231] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0148.231] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0148.288] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2f000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2f000, lpOverlapped=0x0) returned 1 [0148.292] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2f010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2f010, lpOverlapped=0x0) returned 1 [0148.296] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.355] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.370] CloseHandle (hObject=0xe8) returned 1 [0148.370] CloseHandle (hObject=0xf4) returned 1 [0148.374] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0")) returned 0 [0148.375] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0")) returned 0x20 [0148.375] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec849b00, ftCreationTime.dwHighDateTime=0x1d5c5ba, ftLastAccessTime.dwLowDateTime=0xec849b00, ftLastAccessTime.dwHighDateTime=0x1d5c5ba, ftLastWriteTime.dwLowDateTime=0xec849b00, ftLastWriteTime.dwHighDateTime=0x1d5c5ba, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0148.375] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec849b00, ftCreationTime.dwHighDateTime=0x1d5c5ba, ftLastAccessTime.dwLowDateTime=0xec849b00, ftLastAccessTime.dwHighDateTime=0x1d5c5ba, ftLastWriteTime.dwLowDateTime=0xec849b00, ftLastWriteTime.dwHighDateTime=0x1d5c5ba, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0148.375] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0148.376] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0148.379] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{2BC3BD4D-FABA-4394-93C7-9AC82A263FE2}v14.25.28508\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{2bc3bd4d-faba-4394-93c7-9ac82a263fe2}v14.25.28508\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0148.379] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec849b00, ftCreationTime.dwHighDateTime=0x1d5c5ba, ftLastAccessTime.dwLowDateTime=0xec849b00, ftLastAccessTime.dwHighDateTime=0x1d5c5ba, ftLastWriteTime.dwLowDateTime=0xec849b00, ftLastWriteTime.dwHighDateTime=0x1d5c5ba, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0148.379] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0148.379] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0148.379] FindClose (in: hFindFile=0x26ddb0 | out: hFindFile=0x26ddb0) returned 1 [0148.379] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93d96330, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93d96330, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93d96330, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0148.379] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0148.380] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x760275f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x760275f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x61647055, dwReserved1=0x69736574, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0148.380] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x760275f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x760275f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0148.381] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x760275f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x760275f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="..", cAlternateFileName="")) returned 1 [0148.381] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760275f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x760275f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x80d797d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0148.382] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0148.382] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.385] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28a [0148.385] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0148.385] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0148.443] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x28a, lpOverlapped=0x0) returned 1 [0148.445] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x290, lpOverlapped=0x0) returned 1 [0148.446] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.511] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.528] CloseHandle (hObject=0xe4) returned 1 [0148.528] CloseHandle (hObject=0xf0) returned 1 [0148.529] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.ozq0")) returned 0 [0148.530] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm.ozq0")) returned 0x20 [0148.530] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760275f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x760275f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x80d797d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0x26dd90 [0148.530] FindNextFileA (in: hFindFile=0x26dd90, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760275f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x760275f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x80d797d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0 [0148.530] FindClose (in: hFindFile=0x26dd90 | out: hFindFile=0x26dd90) returned 1 [0148.530] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm")) returned 1 [0148.532] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm")) returned 0xffffffff [0148.532] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x75fdb330, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6e172d90, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0148.532] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0148.533] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0148.533] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f428 [0148.533] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0148.534] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0148.596] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6f428, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x6f428, lpOverlapped=0x0) returned 1 [0148.609] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6f430, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6f430, lpOverlapped=0x0) returned 1 [0148.621] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0148.685] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0148.701] CloseHandle (hObject=0xf0) returned 1 [0148.702] CloseHandle (hObject=0xe4) returned 1 [0148.709] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.ozq0")) returned 0 [0148.710] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe.ozq0")) returned 0x20 [0148.710] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x75fdb330, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6e172d90, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0x26dda0 [0148.710] FindNextFileA (in: hFindFile=0x26dda0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x75fdb330, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6e172d90, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0148.710] FindClose (in: hFindFile=0x26dda0 | out: hFindFile=0x26dda0) returned 1 [0148.710] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe")) returned 1 [0148.716] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe")) returned 0xffffffff [0148.716] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75fdb330, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x75fdb330, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6e172d90, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0148.716] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0148.717] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fe1470, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x890075d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x890075d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x69736565, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0148.717] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fe1470, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x890075d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x890075d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0148.717] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fe1470, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x890075d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x890075d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0148.717] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890075d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x890075d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x890075d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="packages", cAlternateFileName="")) returned 1 [0148.717] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890075d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x890075d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x890075d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName=".", cAlternateFileName="")) returned 0x26dda8 [0148.718] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890075d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x890075d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x890075d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="..", cAlternateFileName="")) returned 1 [0148.718] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890075d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x8902d730, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8902d730, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0148.718] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890075d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x8902d730, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8902d730, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0148.718] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890075d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x8902d730, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8902d730, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0148.718] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18637300, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0x18637300, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0x18637300, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0148.718] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0148.719] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0148.723] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x588124 [0148.723] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0148.723] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0148.782] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0148.962] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0149.123] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x88124, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x88124, lpOverlapped=0x0) returned 1 [0149.139] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x88130, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x88130, lpOverlapped=0x0) returned 1 [0149.162] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.219] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.233] CloseHandle (hObject=0xf4) returned 1 [0149.233] CloseHandle (hObject=0xe8) returned 1 [0149.447] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0")) returned 0 [0149.449] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0")) returned 0x20 [0149.449] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18637300, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0x18637300, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0x18637300, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0149.449] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18637300, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0x18637300, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0x18637300, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0149.449] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0149.449] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0149.457] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0149.458] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb35c4d00, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb35c4d00, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb35c4d00, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0149.458] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0149.459] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0149.460] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0149.460] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0149.460] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0149.523] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x25000, lpOverlapped=0x0) returned 1 [0149.533] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x25010, lpOverlapped=0x0) returned 1 [0149.537] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.599] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.646] CloseHandle (hObject=0xe8) returned 1 [0149.646] CloseHandle (hObject=0xf4) returned 1 [0149.655] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0")) returned 0 [0149.656] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0")) returned 0x20 [0149.656] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb35c4d00, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb35c4d00, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb35c4d00, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0149.656] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb35c4d00, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb35c4d00, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb35c4d00, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0149.656] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0149.657] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0149.660] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0149.660] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb35c4d00, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb35c4d00, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb35c4d00, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0149.660] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0149.660] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890075d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x8902d730, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8902d730, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0149.660] FindClose (in: hFindFile=0x26dda8 | out: hFindFile=0x26dda8) returned 1 [0149.661] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x890075d0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x890075d0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x890075d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="packages", cAlternateFileName="")) returned 0 [0149.661] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0149.661] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x201660b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x201b2370, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x201b2370, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x69736565, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0149.661] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x201660b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x201b2370, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x201b2370, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0149.662] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x201660b0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x201b2370, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x201b2370, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0149.662] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x201b2370, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x201b2370, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x23825ab0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0149.662] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0149.662] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.670] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x296 [0149.670] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0149.671] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0149.742] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x296, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x296, lpOverlapped=0x0) returned 1 [0149.743] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x2a0, lpOverlapped=0x0) returned 1 [0149.744] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.809] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0149.825] CloseHandle (hObject=0xe4) returned 1 [0149.826] CloseHandle (hObject=0xf0) returned 1 [0149.827] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.ozq0")) returned 0 [0149.828] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm.ozq0")) returned 0x20 [0149.828] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x201b2370, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x201b2370, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x23825ab0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0x26dd90 [0149.828] FindNextFileA (in: hFindFile=0x26dd90, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x201b2370, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x201b2370, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x23825ab0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0 [0149.828] FindClose (in: hFindFile=0x26dd90 | out: hFindFile=0x26dd90) returned 1 [0149.828] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm")) returned 1 [0149.830] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm")) returned 0xffffffff [0149.830] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2018c210, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x2018c210, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9f5a52b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0149.830] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0149.830] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0149.831] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x710a8 [0149.831] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0149.832] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0149.913] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x710a8, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x710a8, lpOverlapped=0x0) returned 1 [0149.926] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x710b0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x710b0, lpOverlapped=0x0) returned 1 [0149.938] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0149.999] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.014] CloseHandle (hObject=0xf0) returned 1 [0150.014] CloseHandle (hObject=0xe4) returned 1 [0150.055] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.ozq0")) returned 0 [0150.056] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe.ozq0")) returned 0x20 [0150.056] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2018c210, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x2018c210, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9f5a52b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0x26dda0 [0150.057] FindNextFileA (in: hFindFile=0x26dda0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2018c210, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x2018c210, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9f5a52b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0150.057] FindClose (in: hFindFile=0x26dda0 | out: hFindFile=0x26dda0) returned 1 [0150.057] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe")) returned 1 [0150.063] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\vcredist_x64.exe")) returned 0xffffffff [0150.063] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2018c210, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x2018c210, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9f5a52b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0150.063] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0150.063] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93ae8a70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93b0ebd0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93b0ebd0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x69736565, cFileName="{65e650ff-30be-469d-b63a-418d71ea1765}", cAlternateFileName="{65E65~1")) returned 1 [0150.063] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93ae8a70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93b0ebd0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93b0ebd0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0150.064] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93ae8a70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93b0ebd0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x93b0ebd0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0150.064] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b0ebd0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93b0ebd0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9c6c16f0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0150.064] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0150.066] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.069] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x340 [0150.069] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0150.069] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0150.131] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x340, lpOverlapped=0x0) returned 1 [0150.133] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x350, lpOverlapped=0x0) returned 1 [0150.134] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.195] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.219] CloseHandle (hObject=0xe4) returned 1 [0150.219] CloseHandle (hObject=0xf0) returned 1 [0150.221] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm.ozq0")) returned 0 [0150.221] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm.ozq0")) returned 0x20 [0150.221] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b0ebd0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93b0ebd0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9c6c16f0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0x26dd90 [0150.222] FindNextFileA (in: hFindFile=0x26dd90, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93b0ebd0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93b0ebd0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9c6c16f0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0 [0150.222] FindClose (in: hFindFile=0x26dd90 | out: hFindFile=0x26dd90) returned 1 [0150.222] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm")) returned 1 [0150.223] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\state.rsm")) returned 0xffffffff [0150.223] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ae8a70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93ae8a70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x8d4bc670, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x9e2e8, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0150.224] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\vc_redist.x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.224] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\VC_redist.x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\vc_redist.x86.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0150.224] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9e2e8 [0150.224] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0150.225] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0150.282] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9e2e8, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x9e2e8, lpOverlapped=0x0) returned 1 [0150.297] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9e2f0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x9e2f0, lpOverlapped=0x0) returned 1 [0150.313] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.371] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.387] CloseHandle (hObject=0xf0) returned 1 [0150.387] CloseHandle (hObject=0xe4) returned 1 [0150.396] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\vc_redist.x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\VC_redist.x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\vc_redist.x86.exe.ozq0")) returned 0 [0150.396] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\VC_redist.x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\vc_redist.x86.exe.ozq0")) returned 0x20 [0150.396] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\VC_redist.x86.exe", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ae8a70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93ae8a70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x8d4bc670, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x9e2e8, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0x26dda0 [0150.397] FindNextFileA (in: hFindFile=0x26dda0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ae8a70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93ae8a70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x8d4bc670, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x9e2e8, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0150.397] FindClose (in: hFindFile=0x26dda0 | out: hFindFile=0x26dda0) returned 1 [0150.397] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\vc_redist.x86.exe")) returned 1 [0150.405] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\VC_redist.x86.exe" (normalized: "c:\\users\\all users\\package cache\\{65e650ff-30be-469d-b63a-418d71ea1765}\\vc_redist.x86.exe")) returned 0xffffffff [0150.405] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93ae8a70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x93ae8a70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x8d4bc670, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x9e2e8, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0150.405] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0150.405] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504d590, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5099850, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5099850, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3638, dwReserved1=0x69736578, cFileName="{6913e92a-b64e-41c9-a5e6-cef39207fe89}", cAlternateFileName="{6913E~1")) returned 1 [0150.405] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504d590, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5099850, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5099850, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0150.406] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa504d590, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5099850, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5099850, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0150.406] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5099850, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5099850, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3ac4c90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0150.406] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0150.407] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.410] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x340 [0150.410] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0150.410] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0150.473] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x340, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x340, lpOverlapped=0x0) returned 1 [0150.475] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x350, lpOverlapped=0x0) returned 1 [0150.476] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.539] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.554] CloseHandle (hObject=0xe4) returned 1 [0150.554] CloseHandle (hObject=0xf0) returned 1 [0150.556] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm.ozq0")) returned 0 [0150.556] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm.ozq0")) returned 0x20 [0150.557] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5099850, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5099850, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3ac4c90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0x26dd90 [0150.557] FindNextFileA (in: hFindFile=0x26dd90, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5099850, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5099850, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xb3ac4c90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x340, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0 [0150.557] FindClose (in: hFindFile=0x26dd90 | out: hFindFile=0x26dd90) returned 1 [0150.557] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm")) returned 1 [0150.558] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\state.rsm")) returned 0xffffffff [0150.558] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa504d590, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa504d590, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9d3b2e90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x9e218, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0150.558] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\vc_redist.x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0150.559] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\VC_redist.x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\vc_redist.x64.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0150.559] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9e218 [0150.559] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0150.560] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0150.615] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9e218, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x9e218, lpOverlapped=0x0) returned 1 [0150.629] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9e220, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x9e220, lpOverlapped=0x0) returned 1 [0150.646] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0150.712] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0150.725] CloseHandle (hObject=0xf0) returned 1 [0150.725] CloseHandle (hObject=0xe4) returned 1 [0150.732] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\vc_redist.x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\VC_redist.x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\vc_redist.x64.exe.ozq0")) returned 0 [0150.733] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\VC_redist.x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\vc_redist.x64.exe.ozq0")) returned 0x20 [0150.733] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\VC_redist.x64.exe", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa504d590, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa504d590, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9d3b2e90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x9e218, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0x26dda0 [0150.733] FindNextFileA (in: hFindFile=0x26dda0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa504d590, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa504d590, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9d3b2e90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x9e218, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0150.734] FindClose (in: hFindFile=0x26dda0 | out: hFindFile=0x26dda0) returned 1 [0150.734] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\vc_redist.x64.exe")) returned 1 [0150.741] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\VC_redist.x64.exe" (normalized: "c:\\users\\all users\\package cache\\{6913e92a-b64e-41c9-a5e6-cef39207fe89}\\vc_redist.x64.exe")) returned 0xffffffff [0150.741] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa504d590, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa504d590, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x9d3b2e90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x9e218, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0150.741] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0150.741] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3436, dwReserved1=0x69736578, cFileName="{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508", cAlternateFileName="{7D0B7~1.285")) returned 1 [0150.741] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0150.742] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0150.742] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="packages", cAlternateFileName="")) returned 1 [0150.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x26dce0, cFileName=".", cAlternateFileName="")) returned 0x26ddb0 [0150.742] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x26dce0, cFileName="..", cAlternateFileName="")) returned 1 [0150.742] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa52628d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa52628d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x26dce0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0150.742] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa52628d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa52628d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0150.743] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa52628d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa52628d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0150.743] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5b500, ftCreationTime.dwHighDateTime=0x1d5c5bd, ftLastAccessTime.dwLowDateTime=0x4f5b500, ftLastAccessTime.dwHighDateTime=0x1d5c5bd, ftLastWriteTime.dwLowDateTime=0x4f5b500, ftLastWriteTime.dwHighDateTime=0x1d5c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x55f0fd, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0150.743] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0150.743] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0150.746] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x55f0fd [0150.746] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0150.746] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0150.798] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0150.933] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0151.068] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5f0fd, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x5f0fd, lpOverlapped=0x0) returned 1 [0151.093] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5f100, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x5f100, lpOverlapped=0x0) returned 1 [0151.104] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.164] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.180] CloseHandle (hObject=0xf4) returned 1 [0151.180] CloseHandle (hObject=0xe8) returned 1 [0151.455] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0")) returned 0 [0151.456] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0")) returned 0x20 [0151.456] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5b500, ftCreationTime.dwHighDateTime=0x1d5c5bd, ftLastAccessTime.dwLowDateTime=0x4f5b500, ftLastAccessTime.dwHighDateTime=0x1d5c5bd, ftLastWriteTime.dwLowDateTime=0x4f5b500, ftLastWriteTime.dwHighDateTime=0x1d5c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x55f0fd, dwReserved0=0x26ff18, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0151.456] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f5b500, ftCreationTime.dwHighDateTime=0x1d5c5bd, ftLastAccessTime.dwLowDateTime=0x4f5b500, ftLastAccessTime.dwHighDateTime=0x1d5c5bd, ftLastWriteTime.dwLowDateTime=0x4f5b500, ftLastWriteTime.dwHighDateTime=0x1d5c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x55f0fd, dwReserved0=0x26ff18, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0151.456] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0151.457] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0151.462] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0151.463] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d47c00, ftCreationTime.dwHighDateTime=0x1d5c5bd, ftLastAccessTime.dwLowDateTime=0x54d47c00, ftLastAccessTime.dwHighDateTime=0x1d5c5bd, ftLastWriteTime.dwLowDateTime=0x54d47c00, ftLastWriteTime.dwHighDateTime=0x1d5c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0151.463] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0151.464] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.464] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2d000 [0151.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0151.465] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0151.527] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2d000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2d000, lpOverlapped=0x0) returned 1 [0151.536] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2d010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2d010, lpOverlapped=0x0) returned 1 [0151.541] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0151.602] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0151.617] CloseHandle (hObject=0xe8) returned 1 [0151.617] CloseHandle (hObject=0xf4) returned 1 [0151.623] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0")) returned 0 [0151.624] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0")) returned 0x20 [0151.644] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d47c00, ftCreationTime.dwHighDateTime=0x1d5c5bd, ftLastAccessTime.dwLowDateTime=0x54d47c00, ftLastAccessTime.dwHighDateTime=0x1d5c5bd, ftLastWriteTime.dwLowDateTime=0x54d47c00, ftLastWriteTime.dwHighDateTime=0x1d5c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x26ff40, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0151.645] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d47c00, ftCreationTime.dwHighDateTime=0x1d5c5bd, ftLastAccessTime.dwLowDateTime=0x54d47c00, ftLastAccessTime.dwHighDateTime=0x1d5c5bd, ftLastWriteTime.dwLowDateTime=0x54d47c00, ftLastWriteTime.dwHighDateTime=0x1d5c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x26ff40, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0151.645] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0151.645] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0151.648] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{7D0B74C2-C3F8-4AF1-940F-CD79AB4B2DCE}v14.25.28508\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{7d0b74c2-c3f8-4af1-940f-cd79ab4b2dce}v14.25.28508\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0151.648] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54d47c00, ftCreationTime.dwHighDateTime=0x1d5c5bd, ftLastAccessTime.dwLowDateTime=0x54d47c00, ftLastAccessTime.dwHighDateTime=0x1d5c5bd, ftLastWriteTime.dwLowDateTime=0x54d47c00, ftLastWriteTime.dwHighDateTime=0x1d5c5bd, nFileSizeHigh=0x0, nFileSizeLow=0x2d000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0151.648] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0151.648] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa52628d0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa52628d0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb400b2, dwReserved1=0x26dce0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0151.648] FindClose (in: hFindFile=0x26ddb0 | out: hFindFile=0x26ddb0) returned 1 [0151.648] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa523c770, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="packages", cAlternateFileName="")) returned 0 [0151.649] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0151.649] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20296bb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20296bb0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3436, dwReserved1=0x69736578, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0151.649] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20296bb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20296bb0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0151.649] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20296bb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20296bb0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0151.649] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20296bb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20296bb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20296bb0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0151.650] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20296bb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20296bb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20296bb0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x26dda8 [0151.650] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20296bb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20296bb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20296bb0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0151.650] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20296bb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x202e2e70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x202e2e70, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0151.650] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20296bb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x202e2e70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x202e2e70, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0151.651] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20296bb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x202e2e70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x202e2e70, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0151.651] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec82c300, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xec82c300, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xec82c300, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0151.655] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0151.656] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0151.658] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x554520 [0151.659] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0151.659] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0151.712] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0151.911] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x500000, lpOverlapped=0x0) returned 1 [0152.062] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x54520, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x54520, lpOverlapped=0x0) returned 1 [0152.074] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x54530, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x54530, lpOverlapped=0x0) returned 1 [0152.085] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.137] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.180] CloseHandle (hObject=0xf4) returned 1 [0152.180] CloseHandle (hObject=0xe8) returned 1 [0152.423] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0")) returned 0 [0152.424] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.ozq0")) returned 0x20 [0152.424] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec82c300, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xec82c300, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xec82c300, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0152.424] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec82c300, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xec82c300, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xec82c300, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x554520, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0152.424] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0152.424] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 1 [0152.430] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0xffffffff [0152.430] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea206900, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xea206900, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0152.430] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0152.431] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.431] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0152.431] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0152.432] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0152.494] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x23000, lpOverlapped=0x0) returned 1 [0152.498] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x23010, lpOverlapped=0x0) returned 1 [0152.502] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.563] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.576] CloseHandle (hObject=0xe8) returned 1 [0152.576] CloseHandle (hObject=0xf4) returned 1 [0152.579] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0")) returned 0 [0152.579] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.ozq0")) returned 0x20 [0152.579] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea206900, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xea206900, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0152.580] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea206900, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xea206900, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0152.580] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0152.580] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 1 [0152.582] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0xffffffff [0152.582] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea206900, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xea206900, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0152.582] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0152.582] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20296bb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x202e2e70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x202e2e70, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0152.582] FindClose (in: hFindFile=0x26dda8 | out: hFindFile=0x26dda8) returned 1 [0152.582] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20296bb0, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20296bb0, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20296bb0, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0152.583] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0152.583] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20224790, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3436, dwReserved1=0x69736578, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0152.583] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20224790, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0152.583] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20224790, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0152.583] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0152.583] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x26dda8 [0152.584] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0152.584] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0152.584] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0152.584] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0152.584] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb519600, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xeb519600, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xeb519600, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0152.584] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.585] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0152.587] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfc90a [0152.587] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0152.587] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0152.635] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xfc90a, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xfc90a, lpOverlapped=0x0) returned 1 [0152.654] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xfc910, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xfc910, lpOverlapped=0x0) returned 1 [0152.677] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.738] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0152.750] CloseHandle (hObject=0xf4) returned 1 [0152.750] CloseHandle (hObject=0xe8) returned 1 [0152.848] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0")) returned 0 [0152.848] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0")) returned 0x20 [0152.849] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb519600, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xeb519600, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xeb519600, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0152.849] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb519600, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xeb519600, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xeb519600, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0152.849] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0152.849] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0152.861] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0152.862] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea206900, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xea206900, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0152.862] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0152.862] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0152.863] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0152.863] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0152.863] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0152.918] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x23000, lpOverlapped=0x0) returned 1 [0152.923] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x23010, lpOverlapped=0x0) returned 1 [0152.928] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0152.983] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.019] CloseHandle (hObject=0xe8) returned 1 [0153.019] CloseHandle (hObject=0xf4) returned 1 [0153.022] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0")) returned 0 [0153.024] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0")) returned 0x20 [0153.024] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea206900, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xea206900, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x26ff28, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0153.024] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea206900, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xea206900, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x26ff28, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.024] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0153.024] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0153.026] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0153.026] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea206900, ftCreationTime.dwHighDateTime=0x1cf3e1d, ftLastAccessTime.dwLowDateTime=0xea206900, ftLastAccessTime.dwHighDateTime=0x1cf3e1d, ftLastWriteTime.dwLowDateTime=0xea206900, ftLastWriteTime.dwHighDateTime=0x1cf3e1d, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.026] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0153.026] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0153.026] FindClose (in: hFindFile=0x26dda8 | out: hFindFile=0x26dda8) returned 1 [0153.027] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20270a50, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x20270a50, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x20270a50, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0153.027] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0153.027] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3436, dwReserved1=0x69736578, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0153.027] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0153.027] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="..", cAlternateFileName="")) returned 1 [0153.027] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0153.027] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x26dda8 [0153.028] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0153.028] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9fc3b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9fc3b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0153.028] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9fc3b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9fc3b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0153.028] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9fc3b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9fc3b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0153.028] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa960e00, ftCreationTime.dwHighDateTime=0x1ced524, ftLastAccessTime.dwLowDateTime=0xfa960e00, ftLastAccessTime.dwHighDateTime=0x1ced524, ftLastWriteTime.dwLowDateTime=0xfa960e00, ftLastWriteTime.dwHighDateTime=0x1ced524, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.028] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0153.029] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0153.034] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ea418 [0153.034] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0153.034] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0153.081] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ea418, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4ea418, lpOverlapped=0x0) returned 1 [0153.219] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4ea420, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4ea420, lpOverlapped=0x0) returned 1 [0153.409] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.470] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.482] CloseHandle (hObject=0xf4) returned 1 [0153.483] CloseHandle (hObject=0xe8) returned 1 [0153.658] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0")) returned 0 [0153.660] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0")) returned 0x20 [0153.660] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa960e00, ftCreationTime.dwHighDateTime=0x1ced524, ftLastAccessTime.dwLowDateTime=0xfa960e00, ftLastAccessTime.dwHighDateTime=0x1ced524, ftLastWriteTime.dwLowDateTime=0xfa960e00, ftLastWriteTime.dwHighDateTime=0x1ced524, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0153.660] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa960e00, ftCreationTime.dwHighDateTime=0x1ced524, ftLastAccessTime.dwLowDateTime=0xfa960e00, ftLastAccessTime.dwHighDateTime=0x1ced524, ftLastWriteTime.dwLowDateTime=0xfa960e00, ftLastWriteTime.dwHighDateTime=0x1ced524, nFileSizeHigh=0x0, nFileSizeLow=0x4ea418, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0153.660] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0153.660] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0153.671] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0153.671] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8210100, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb8210100, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb8210100, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0153.671] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0153.672] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0153.673] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0153.673] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0153.674] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0153.741] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x25000, lpOverlapped=0x0) returned 1 [0153.758] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x25010, lpOverlapped=0x0) returned 1 [0153.763] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0153.850] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0153.865] CloseHandle (hObject=0xe8) returned 1 [0153.865] CloseHandle (hObject=0xf4) returned 1 [0153.956] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0")) returned 0 [0153.956] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0")) returned 0x20 [0153.956] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8210100, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb8210100, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb8210100, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0153.957] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8210100, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb8210100, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb8210100, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.957] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0153.957] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0153.960] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0153.960] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8210100, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb8210100, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb8210100, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.960] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0153.960] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9fc3b0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9fc3b0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0153.960] FindClose (in: hFindFile=0x26dda8 | out: hFindFile=0x26dda8) returned 1 [0153.960] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f9b00f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0153.960] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0153.960] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76131f90, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3436, dwReserved1=0x69736578, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0153.960] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76131f90, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0153.961] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x76131f90, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="..", cAlternateFileName="")) returned 1 [0153.961] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 1 [0153.961] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName=".", cAlternateFileName="")) returned 0x26dda8 [0153.962] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="..", cAlternateFileName="")) returned 1 [0153.962] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0153.962] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0153.962] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0153.962] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf833b400, ftCreationTime.dwHighDateTime=0x1ced524, ftLastAccessTime.dwLowDateTime=0xf833b400, ftLastAccessTime.dwHighDateTime=0x1ced524, ftLastWriteTime.dwLowDateTime=0xf833b400, ftLastWriteTime.dwHighDateTime=0x1ced524, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.962] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0153.963] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0153.967] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc89b1 [0153.968] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0153.968] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0154.082] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc89b1, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xc89b1, lpOverlapped=0x0) returned 1 [0154.122] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc89c0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xc89c0, lpOverlapped=0x0) returned 1 [0154.139] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.197] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.211] CloseHandle (hObject=0xf4) returned 1 [0154.211] CloseHandle (hObject=0xe8) returned 1 [0154.287] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0")) returned 0 [0154.287] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab.ozq0")) returned 0x20 [0154.287] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf833b400, ftCreationTime.dwHighDateTime=0x1ced524, ftLastAccessTime.dwLowDateTime=0xf833b400, ftLastAccessTime.dwHighDateTime=0x1ced524, ftLastWriteTime.dwLowDateTime=0xf833b400, ftLastWriteTime.dwHighDateTime=0x1ced524, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x26ff00, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0154.287] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf833b400, ftCreationTime.dwHighDateTime=0x1ced524, ftLastAccessTime.dwLowDateTime=0xf833b400, ftLastAccessTime.dwHighDateTime=0x1ced524, ftLastWriteTime.dwLowDateTime=0xf833b400, ftLastWriteTime.dwHighDateTime=0x1ced524, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x26ff00, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0154.288] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0154.288] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 1 [0154.297] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\cab1.cab")) returned 0xffffffff [0154.297] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8210100, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb8210100, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb8210100, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0154.297] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0154.298] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0154.298] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0154.298] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0154.299] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0154.365] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x25000, lpOverlapped=0x0) returned 1 [0154.400] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x25010, lpOverlapped=0x0) returned 1 [0154.404] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.472] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.486] CloseHandle (hObject=0xe8) returned 1 [0154.487] CloseHandle (hObject=0xf4) returned 1 [0154.489] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0")) returned 0 [0154.490] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi.ozq0")) returned 0x20 [0154.490] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8210100, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb8210100, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb8210100, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ff20, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0154.491] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8210100, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb8210100, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb8210100, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ff20, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0154.491] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0154.491] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 1 [0154.493] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\vc_runtimeMinimum_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\vc_runtimeminimum_x86.msi")) returned 0xffffffff [0154.493] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8210100, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xb8210100, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xb8210100, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0154.493] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0154.493] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f9b00f0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f9b00f0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74696464, dwReserved1=0x616e6f69, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0154.493] FindClose (in: hFindFile=0x26dda8 | out: hFindFile=0x26dda8) returned 1 [0154.493] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69746964, dwReserved1=0x6c616e6f, cFileName="packages", cAlternateFileName="")) returned 0 [0154.493] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0154.493] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88dcc130, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x652e3436, dwReserved1=0x69736578, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0154.493] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88dcc130, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0154.494] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88dcc130, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="..", cAlternateFileName="")) returned 1 [0154.494] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8c713290, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x756d696e, dwReserved1=0x38785f6d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0154.494] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0154.494] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.498] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x28a [0154.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0154.498] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0154.556] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x28a, lpOverlapped=0x0) returned 1 [0154.557] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x290, lpOverlapped=0x0) returned 1 [0154.559] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.622] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.634] CloseHandle (hObject=0xe4) returned 1 [0154.634] CloseHandle (hObject=0xf0) returned 1 [0154.635] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.ozq0")) returned 0 [0154.637] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm.ozq0")) returned 0x20 [0154.637] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8c713290, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0x26dd90 [0154.637] FindNextFileA (in: hFindFile=0x26dd90, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8c713290, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0 [0154.637] FindClose (in: hFindFile=0x26dd90 | out: hFindFile=0x26dd90) returned 1 [0154.637] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 1 [0154.638] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 0xffffffff [0154.638] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x80eaa2d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0154.638] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0154.639] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0154.639] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6f398 [0154.639] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0154.640] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0154.694] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6f398, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x6f398, lpOverlapped=0x0) returned 1 [0154.706] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6f3a0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6f3a0, lpOverlapped=0x0) returned 1 [0154.725] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.785] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0154.798] CloseHandle (hObject=0xf0) returned 1 [0154.798] CloseHandle (hObject=0xe4) returned 1 [0154.812] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.ozq0")) returned 0 [0154.812] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe.ozq0")) returned 0x20 [0154.812] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x80eaa2d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0x26dda0 [0154.812] FindNextFileA (in: hFindFile=0x26dda0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x80eaa2d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0154.812] FindClose (in: hFindFile=0x26dda0 | out: hFindFile=0x26dda0) returned 1 [0154.813] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe")) returned 1 [0154.818] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\vcredist_x64.exe")) returned 0xffffffff [0154.818] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88dcc130, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88dcc130, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x80eaa2d0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0154.818] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0154.818] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88f6f050, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fbb310, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fbb310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x69736565, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0154.818] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88f6f050, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fbb310, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fbb310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0154.819] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88f6f050, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fbb310, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fbb310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0154.819] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fbb310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fbb310, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fbb310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="packages", cAlternateFileName="")) returned 1 [0154.819] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fbb310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fbb310, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fbb310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName=".", cAlternateFileName="")) returned 0x26dda8 [0154.819] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fbb310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fbb310, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fbb310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="..", cAlternateFileName="")) returned 1 [0154.819] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fbb310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fe1470, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fe1470, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0154.819] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fbb310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fe1470, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fe1470, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0154.820] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fbb310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fe1470, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fe1470, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0154.820] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681d000, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0x681d000, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0x681d000, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0154.820] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0154.820] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0154.825] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc5b25 [0154.825] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0154.825] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0154.880] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc5b25, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xc5b25, lpOverlapped=0x0) returned 1 [0154.917] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc5b30, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xc5b30, lpOverlapped=0x0) returned 1 [0154.937] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0154.995] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.007] CloseHandle (hObject=0xf4) returned 1 [0155.007] CloseHandle (hObject=0xe8) returned 1 [0155.054] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0")) returned 0 [0155.055] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0")) returned 0x20 [0155.055] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681d000, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0x681d000, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0x681d000, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0155.055] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x681d000, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0x681d000, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0x681d000, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0155.055] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0155.055] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0155.063] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0155.063] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca02a400, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xca02a400, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xca02a400, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0155.064] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0155.064] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0155.064] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25000 [0155.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0155.065] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0155.141] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x25000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x25000, lpOverlapped=0x0) returned 1 [0155.149] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x25010, lpOverlapped=0x0) returned 1 [0155.154] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.218] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.233] CloseHandle (hObject=0xe8) returned 1 [0155.234] CloseHandle (hObject=0xf4) returned 1 [0155.239] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0")) returned 0 [0155.240] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0")) returned 0x20 [0155.240] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca02a400, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xca02a400, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xca02a400, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ff28, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0155.240] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca02a400, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xca02a400, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xca02a400, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x26ff28, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0155.240] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0155.240] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0155.243] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0155.243] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca02a400, ftCreationTime.dwHighDateTime=0x1ced525, ftLastAccessTime.dwLowDateTime=0xca02a400, ftLastAccessTime.dwHighDateTime=0x1ced525, ftLastWriteTime.dwLowDateTime=0xca02a400, ftLastWriteTime.dwHighDateTime=0x1ced525, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0155.243] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0155.243] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fbb310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fe1470, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fe1470, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0155.244] FindClose (in: hFindFile=0x26dda8 | out: hFindFile=0x26dda8) returned 1 [0155.244] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88fbb310, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x88fbb310, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x88fbb310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="packages", cAlternateFileName="")) returned 0 [0155.246] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0155.246] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9bf0ba10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e34, dwReserved1=0x69736565, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0155.246] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9bf0ba10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0155.246] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9bf0ba10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="..", cAlternateFileName="")) returned 1 [0155.246] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9f239310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0155.247] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0155.247] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.251] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x296 [0155.251] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0155.252] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0155.320] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x296, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x296, lpOverlapped=0x0) returned 1 [0155.321] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x2a0, lpOverlapped=0x0) returned 1 [0155.323] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.384] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.397] CloseHandle (hObject=0xe4) returned 1 [0155.397] CloseHandle (hObject=0xf0) returned 1 [0155.398] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.ozq0")) returned 0 [0155.399] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.ozq0" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm.ozq0")) returned 0x20 [0155.399] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9f239310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0x26dd90 [0155.399] FindNextFileA (in: hFindFile=0x26dd90, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9f239310, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x296, dwReserved0=0x26dd98, dwReserved1=0x18f314, cFileName="state.rsm", cAlternateFileName="")) returned 0 [0155.400] FindClose (in: hFindFile=0x26dd90 | out: hFindFile=0x26dd90) returned 1 [0155.400] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm")) returned 1 [0155.402] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm")) returned 0xffffffff [0155.402] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8c869ef0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0155.402] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0155.402] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0155.403] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x71080 [0155.403] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0155.404] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0155.462] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x71080, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x71080, lpOverlapped=0x0) returned 1 [0155.472] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x71090, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x71090, lpOverlapped=0x0) returned 1 [0155.483] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.553] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.566] CloseHandle (hObject=0xf0) returned 1 [0155.567] CloseHandle (hObject=0xe4) returned 1 [0155.575] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.ozq0")) returned 0 [0155.575] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.ozq0" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe.ozq0")) returned 0x20 [0155.575] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8c869ef0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0x26dda0 [0155.576] FindNextFileA (in: hFindFile=0x26dda0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8c869ef0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x26dda8, dwReserved1=0x18f314, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0155.576] FindClose (in: hFindFile=0x26dda0 | out: hFindFile=0x26dda0) returned 1 [0155.576] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe")) returned 1 [0155.581] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\vcredist_x86.exe")) returned 0xffffffff [0155.581] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bf0ba10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9bf0ba10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x8c869ef0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0155.581] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0155.581] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5216610, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5216610, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x69736565, cFileName="{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508", cAlternateFileName="{EEA66~1.285")) returned 1 [0155.581] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5216610, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5216610, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0155.582] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5216610, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5216610, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0155.582] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5216610, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5216610, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="packages", cAlternateFileName="")) returned 1 [0155.582] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5216610, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5216610, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName=".", cAlternateFileName="")) returned 0x26ddb0 [0155.582] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5216610, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5216610, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="..", cAlternateFileName="")) returned 1 [0155.582] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0155.582] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0155.583] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0155.583] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9153a800, ftCreationTime.dwHighDateTime=0x1d5c5bc, ftLastAccessTime.dwLowDateTime=0x9153a800, ftLastAccessTime.dwHighDateTime=0x1d5c5bc, ftLastWriteTime.dwLowDateTime=0x9153a800, ftLastWriteTime.dwHighDateTime=0x1d5c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x1704ac, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0155.583] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0155.583] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0155.586] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1704ac [0155.586] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0155.586] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0155.643] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1704ac, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1704ac, lpOverlapped=0x0) returned 1 [0155.693] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1704b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x1704b0, lpOverlapped=0x0) returned 1 [0155.746] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.809] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0155.826] CloseHandle (hObject=0xf4) returned 1 [0155.826] CloseHandle (hObject=0xe8) returned 1 [0155.855] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0")) returned 0 [0155.856] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\cab1.cab.ozq0")) returned 0x20 [0155.856] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9153a800, ftCreationTime.dwHighDateTime=0x1d5c5bc, ftLastAccessTime.dwLowDateTime=0x9153a800, ftLastAccessTime.dwHighDateTime=0x1d5c5bc, ftLastWriteTime.dwLowDateTime=0x9153a800, ftLastWriteTime.dwHighDateTime=0x1d5c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x1704ac, dwReserved0=0x26ff10, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0155.856] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9153a800, ftCreationTime.dwHighDateTime=0x1d5c5bc, ftLastAccessTime.dwLowDateTime=0x9153a800, ftLastAccessTime.dwHighDateTime=0x1d5c5bc, ftLastWriteTime.dwLowDateTime=0x9153a800, ftLastWriteTime.dwHighDateTime=0x1d5c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x1704ac, dwReserved0=0x26ff10, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0155.856] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0155.856] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 1 [0155.861] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\cab1.cab")) returned 0xffffffff [0155.861] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbbd4500, ftCreationTime.dwHighDateTime=0x1d5c5bc, ftLastAccessTime.dwLowDateTime=0xcbbd4500, ftLastAccessTime.dwHighDateTime=0x1d5c5bc, ftLastWriteTime.dwLowDateTime=0xcbbd4500, ftLastWriteTime.dwHighDateTime=0x1d5c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0155.861] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0155.862] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0155.862] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2f000 [0155.862] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0155.863] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0155.923] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2f000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2f000, lpOverlapped=0x0) returned 1 [0155.929] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2f010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2f010, lpOverlapped=0x0) returned 1 [0155.934] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0155.990] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.002] CloseHandle (hObject=0xe8) returned 1 [0156.003] CloseHandle (hObject=0xf4) returned 1 [0156.005] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0")) returned 0 [0156.006] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.ozq0")) returned 0x20 [0156.006] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbbd4500, ftCreationTime.dwHighDateTime=0x1d5c5bc, ftLastAccessTime.dwLowDateTime=0xcbbd4500, ftLastAccessTime.dwHighDateTime=0x1d5c5bc, ftLastWriteTime.dwLowDateTime=0xcbbd4500, ftLastWriteTime.dwHighDateTime=0x1d5c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0156.006] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbbd4500, ftCreationTime.dwHighDateTime=0x1d5c5bc, ftLastAccessTime.dwLowDateTime=0xcbbd4500, ftLastAccessTime.dwHighDateTime=0x1d5c5bc, ftLastWriteTime.dwLowDateTime=0xcbbd4500, ftLastWriteTime.dwHighDateTime=0x1d5c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0156.006] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0156.006] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 1 [0156.010] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{EEA66967-97E2-4561-A999-5C22E3CDE428}v14.25.28508\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\users\\all users\\package cache\\{eea66967-97e2-4561-a999-5c22e3cde428}v14.25.28508\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0xffffffff [0156.010] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbbd4500, ftCreationTime.dwHighDateTime=0x1d5c5bc, ftLastAccessTime.dwLowDateTime=0xcbbd4500, ftLastAccessTime.dwHighDateTime=0x1d5c5bc, ftLastWriteTime.dwLowDateTime=0xcbbd4500, ftLastWriteTime.dwHighDateTime=0x1d5c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x2f000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0156.010] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0156.010] FindNextFileA (in: hFindFile=0x26ddb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa523c770, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa523c770, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb200b0, dwReserved1=0x26dce0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0156.010] FindClose (in: hFindFile=0x26ddb0 | out: hFindFile=0x26ddb0) returned 1 [0156.010] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa5216610, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0xa5216610, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0xa5216610, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="packages", cAlternateFileName="")) returned 0 [0156.011] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0156.011] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c22b6f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c251850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c251850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x69736565, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0156.011] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c22b6f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c251850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c251850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0156.011] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c22b6f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c251850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c251850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="..", cAlternateFileName="")) returned 1 [0156.011] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c251850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c251850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c251850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 1 [0156.011] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c251850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c251850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c251850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName=".", cAlternateFileName="")) returned 0x26dda8 [0156.011] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c251850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c251850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c251850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="..", cAlternateFileName="")) returned 1 [0156.011] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c251850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c29db10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c29db10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0156.012] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c251850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c29db10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c29db10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dce0 [0156.012] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c251850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c29db10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c29db10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0156.012] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3166700, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc3166700, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc3166700, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0156.012] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0156.013] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0156.015] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4b4520 [0156.015] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0156.015] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0156.069] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4b4520, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4b4520, lpOverlapped=0x0) returned 1 [0156.287] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4b4530, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4b4530, lpOverlapped=0x0) returned 1 [0156.441] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.504] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.518] CloseHandle (hObject=0xf4) returned 1 [0156.518] CloseHandle (hObject=0xe8) returned 1 [0156.563] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0")) returned 0 [0156.564] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.ozq0" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.ozq0")) returned 0x20 [0156.564] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3166700, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc3166700, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc3166700, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0x26dd20 [0156.564] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3166700, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xc3166700, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xc3166700, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x26ff08, dwReserved1=0x18ee44, cFileName="cab1.cab", cAlternateFileName="")) returned 0 [0156.564] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0156.564] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 1 [0156.574] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab")) returned 0xffffffff [0156.574] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf82e000, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xbf82e000, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xbf82e000, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0156.574] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0156.574] CreateFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0156.575] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23000 [0156.576] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0156.576] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0156.639] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x23000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x23000, lpOverlapped=0x0) returned 1 [0156.642] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x23010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x23010, lpOverlapped=0x0) returned 1 [0156.646] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.709] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.721] CloseHandle (hObject=0xe8) returned 1 [0156.722] CloseHandle (hObject=0xf4) returned 1 [0156.722] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi"), lpNewFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0")) returned 0 [0156.723] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi.ozq0" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi.ozq0")) returned 0x20 [0156.723] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf82e000, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xbf82e000, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xbf82e000, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0x26dd20 [0156.723] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf82e000, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xbf82e000, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xbf82e000, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x26ff30, dwReserved1=0x18ee44, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0156.723] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0156.723] DeleteFileA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 1 [0156.725] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\vc_runtimeAdditional_x86.msi" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\vc_runtimeadditional_x86.msi")) returned 0xffffffff [0156.725] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf82e000, ftCreationTime.dwHighDateTime=0x1cf3e1e, ftLastAccessTime.dwLowDateTime=0xbf82e000, ftLastAccessTime.dwHighDateTime=0x1cf3e1e, ftLastWriteTime.dwLowDateTime=0xbf82e000, ftLastWriteTime.dwHighDateTime=0x1cf3e1e, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0156.725] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0156.725] FindNextFileA (in: hFindFile=0x26dda8, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c251850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c29db10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c29db10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d696e69, dwReserved1=0x785f6d75, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0156.725] FindClose (in: hFindFile=0x26dda8 | out: hFindFile=0x26dda8) returned 1 [0156.725] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c251850, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c251850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c251850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x756d696e, dwReserved1=0x6d615f6d, cFileName="packages", cAlternateFileName="")) returned 0 [0156.725] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0156.725] FindNextFileA (in: hFindFile=0x26bc90, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9c22b6f0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x9c251850, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x9c251850, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x69736565, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0156.725] FindClose (in: hFindFile=0x26bc90 | out: hFindFile=0x26bc90) returned 1 [0156.726] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9189b1f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe69290d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d374532, dwReserved1=0x31373933, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0156.726] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9189b1f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe69290d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x69736565, cFileName=".", cAlternateFileName="")) returned 0x26bca8 [0156.733] FindNextFileA (in: hFindFile=0x26bca8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9189b1f0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe69290d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78652e36, dwReserved1=0x69736565, cFileName="..", cAlternateFileName="")) returned 1 [0156.733] FindNextFileA (in: hFindFile=0x26bca8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xdb786710, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x78652e36, dwReserved1=0x69736565, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 1 [0156.733] CreateFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.734] CreateFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0156.735] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x430 [0156.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0156.736] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0156.792] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x430, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x430, lpOverlapped=0x0) returned 1 [0156.795] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x440, lpOverlapped=0x0) returned 1 [0156.796] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.858] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0156.871] CloseHandle (hObject=0xdc) returned 1 [0156.871] CloseHandle (hObject=0xe4) returned 1 [0156.872] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag"), lpNewFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.ozq0")) returned 0 [0156.872] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag.ozq0")) returned 0x2020 [0156.873] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xdb786710, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x26ce08, dwReserved1=0x18f57c, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 0x26bc38 [0156.873] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xdb786710, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x26ce08, dwReserved1=0x18f57c, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag", cAlternateFileName="REGID1~2.SWI")) returned 0 [0156.873] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0156.873] DeleteFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag")) returned 1 [0156.874] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Extensibility Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run extensibility component.swidtag")) returned 0xffffffff [0156.874] FindNextFileA (in: hFindFile=0x26bca8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58c6200, ftCreationTime.dwHighDateTime=0x1d0d7d0, ftLastAccessTime.dwLowDateTime=0x918c1350, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x58c6200, ftLastWriteTime.dwHighDateTime=0x1d0d7d0, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 1 [0156.875] CreateFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0156.875] CreateFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0156.875] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42c [0156.875] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0156.876] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0156.933] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x42c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x42c, lpOverlapped=0x0) returned 1 [0156.934] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x430, lpOverlapped=0x0) returned 1 [0156.935] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0156.993] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.009] CloseHandle (hObject=0xe4) returned 1 [0157.009] CloseHandle (hObject=0xdc) returned 1 [0157.009] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag"), lpNewFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.ozq0")) returned 0 [0157.010] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag.ozq0")) returned 0x2020 [0157.010] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58c6200, ftCreationTime.dwHighDateTime=0x1d0d7d0, ftLastAccessTime.dwLowDateTime=0x918c1350, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x58c6200, ftLastWriteTime.dwHighDateTime=0x1d0d7d0, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x26ce00, dwReserved1=0x18f57c, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0x26bc38 [0157.010] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58c6200, ftCreationTime.dwHighDateTime=0x1d0d7d0, ftLastAccessTime.dwLowDateTime=0x918c1350, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x58c6200, ftLastWriteTime.dwHighDateTime=0x1d0d7d0, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x26ce00, dwReserved1=0x18f57c, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag", cAlternateFileName="REGID1~1.SWI")) returned 0 [0157.011] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0157.011] DeleteFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag")) returned 1 [0157.012] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Licensing Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run licensing component.swidtag")) returned 0xffffffff [0157.012] FindNextFileA (in: hFindFile=0x26bca8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 1 [0157.012] CreateFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.013] CreateFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0157.013] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42f [0157.013] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0157.014] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0157.075] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x42f, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x42f, lpOverlapped=0x0) returned 1 [0157.077] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x430, lpOverlapped=0x0) returned 1 [0157.078] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.143] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.158] CloseHandle (hObject=0xdc) returned 1 [0157.159] CloseHandle (hObject=0xe4) returned 1 [0157.159] MoveFileA (lpExistingFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag"), lpNewFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.ozq0")) returned 0 [0157.160] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag.ozq0" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag.ozq0")) returned 0x2020 [0157.160] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x26ce08, dwReserved1=0x18f57c, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 0x26bc38 [0157.160] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x26ce08, dwReserved1=0x18f57c, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 0 [0157.160] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0157.160] DeleteFileA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag")) returned 1 [0157.162] GetFileAttributesA (lpFileName="C:\\Users\\All Users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag" (normalized: "c:\\users\\all users\\regid.1991-06.com.microsoft\\regid.1991-06.com.microsoft office 16 click-to-run localization component.swidtag")) returned 0xffffffff [0157.162] FindNextFileA (in: hFindFile=0x26bca8, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="REGID1~3.SWI")) returned 0 [0157.162] FindClose (in: hFindFile=0x26bca8 | out: hFindFile=0x26bca8) returned 1 [0157.162] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6d2e6d6f, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0157.162] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="ð«&")) returned 0xffffffff [0157.163] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6d2e6d6f, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0157.163] FindFirstFileA (in: lpFileName="C:\\Users\\All Users\\Templates\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf73e4600, ftCreationTime.dwHighDateTime=0x1d0d7cf, ftLastAccessTime.dwLowDateTime=0xe69290d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf73e4600, ftLastWriteTime.dwHighDateTime=0x1d0d7cf, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="regid.1991-06.com.microsoft Office 16 Click-to-Run Localization Component.swidtag", cAlternateFileName="ð«&")) returned 0xffffffff [0157.163] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6d2e6d6f, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0157.163] FindClose (in: hFindFile=0x26abf0 | out: hFindFile=0x26abf0) returned 1 [0157.164] FindNextFileA (in: hFindFile=0x269b70, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x632e3630, dwReserved1=0x6d2e6d6f, cFileName="Default", cAlternateFileName="")) returned 1 [0157.164] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\*.*", lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6d2e6d6f, cFileName=".", cAlternateFileName="")) returned 0x26abf0 [0157.164] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x629b4b20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6d2e6d6f, cFileName="..", cAlternateFileName="")) returned 1 [0157.164] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6d2e6d6f, cFileName="AppData", cAlternateFileName="")) returned 1 [0157.164] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0157.165] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0157.165] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Local", cAlternateFileName="")) returned 1 [0157.165] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ccd0 [0157.166] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0157.166] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x76f73c74, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0157.166] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x3a, ftCreationTime.dwLowDateTime=0x7a00146e, ftCreationTime.dwHighDateTime=0x2500c4, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x2574c0, ftLastWriteTime.dwLowDateTime=0xc0002, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x26bc78, nFileSizeLow=0x26bc78, dwReserved0=0x26bc73, dwReserved1=0x0, cFileName="°ó\x18", cAlternateFileName="ÐÌ&")) returned 0xffffffff [0157.167] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x76f73c74, cFileName="History", cAlternateFileName="")) returned 1 [0157.167] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x3a, ftCreationTime.dwLowDateTime=0x7a00146e, ftCreationTime.dwHighDateTime=0x2500c4, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x2574c0, ftLastWriteTime.dwLowDateTime=0xc0002, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x26bc78, nFileSizeLow=0x26bc78, dwReserved0=0x26bc73, dwReserved1=0x0, cFileName="°ó\x18", cAlternateFileName="ÐÌ&")) returned 0xffffffff [0157.167] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0xa0000003, dwReserved1=0x76f73c74, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0157.167] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0157.168] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0157.168] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbd7f0 [0157.168] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0157.169] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0157.279] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0xbd7f0, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xbd7f0, lpOverlapped=0x0) returned 1 [0157.300] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xbd800, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xbd800, lpOverlapped=0x0) returned 1 [0157.320] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.391] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.407] CloseHandle (hObject=0xdc) returned 1 [0157.407] CloseHandle (hObject=0xf0) returned 1 [0157.408] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db.ozq0")) returned 0 [0157.408] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db.ozq0")) returned 0x2020 [0157.408] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0x26dd88, dwReserved1=0x18f314, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 0x26cc80 [0157.408] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0x26dd88, dwReserved1=0x18f314, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 0 [0157.408] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0157.409] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db")) returned 1 [0157.418] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\default\\appdata\\local\\iconcache.db")) returned 0xffffffff [0157.418] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0157.418] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName=".", cAlternateFileName="")) returned 0x26cc80 [0157.420] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="..", cAlternateFileName="")) returned 1 [0157.420] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0157.420] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0157.421] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 1 [0157.421] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 0 [0157.421] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0157.421] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x580056, dwReserved1=0x26dd18, cFileName="Feeds", cAlternateFileName="")) returned 1 [0157.421] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName=".", cAlternateFileName="")) returned 0x26ed90 [0157.423] FindNextFileA (in: hFindFile=0x26ed90, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 1 [0157.423] FindNextFileA (in: hFindFile=0x26ed90, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0157.424] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.424] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0157.425] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a00 [0157.425] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0157.425] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0157.553] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1a00, lpOverlapped=0x0) returned 1 [0157.556] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x1a10, lpOverlapped=0x0) returned 1 [0157.557] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.630] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.647] CloseHandle (hObject=0xf4) returned 1 [0157.647] CloseHandle (hObject=0xe8) returned 1 [0157.647] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.ozq0")) returned 0 [0157.648] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.ozq0")) returned 0x2020 [0157.648] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 0x26ed20 [0157.648] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 0 [0157.648] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0157.649] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 1 [0157.650] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 0xffffffff [0157.650] FindNextFileA (in: hFindFile=0x26ed90, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1 [0157.650] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x26fdd8, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0157.652] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x26fdd8, cFileName="..", cAlternateFileName="")) returned 1 [0157.652] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x8a0088, dwReserved1=0x26fdd8, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0157.653] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.653] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0157.653] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0157.654] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0157.654] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0157.781] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x7000, lpOverlapped=0x0) returned 1 [0157.784] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x7010, lpOverlapped=0x0) returned 1 [0157.786] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0157.848] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0157.864] CloseHandle (hObject=0xf4) returned 1 [0157.864] CloseHandle (hObject=0xe0) returned 1 [0157.865] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ozq0")) returned 0 [0157.865] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ozq0")) returned 0x2020 [0157.866] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 0x270ea0 [0157.866] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 0 [0157.866] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0157.866] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 1 [0157.867] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 0xffffffff [0157.867] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1 [0157.868] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0157.868] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0157.869] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0157.869] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0157.869] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0157.991] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x7000, lpOverlapped=0x0) returned 1 [0157.994] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x7010, lpOverlapped=0x0) returned 1 [0157.996] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.056] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.071] CloseHandle (hObject=0xe0) returned 1 [0158.071] CloseHandle (hObject=0xf4) returned 1 [0158.072] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ozq0")) returned 0 [0158.072] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ozq0")) returned 0x2020 [0158.072] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 0x270ea0 [0158.072] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 0 [0158.073] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0158.073] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 1 [0158.074] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 0xffffffff [0158.074] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1 [0158.074] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0158.075] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0158.075] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0158.075] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0158.076] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0158.197] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x7000, lpOverlapped=0x0) returned 1 [0158.226] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x7010, lpOverlapped=0x0) returned 1 [0158.228] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.352] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.377] CloseHandle (hObject=0xf4) returned 1 [0158.377] CloseHandle (hObject=0xe0) returned 1 [0158.378] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ozq0")) returned 0 [0158.378] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ozq0")) returned 0x2020 [0158.378] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0x270e90 [0158.379] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0158.379] FindClose (in: hFindFile=0x270e90 | out: hFindFile=0x270e90) returned 1 [0158.379] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 1 [0158.381] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 0xffffffff [0158.381] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0158.381] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0158.381] FindNextFileA (in: hFindFile=0x26ed90, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0158.381] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0158.381] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0158.382] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0158.382] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x270de0, cFileName=".", cAlternateFileName="")) returned 0x270eb8 [0158.382] FindNextFileA (in: hFindFile=0x270eb8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x270de0, cFileName="..", cAlternateFileName="")) returned 1 [0158.382] FindNextFileA (in: hFindFile=0x270eb8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa800a6, dwReserved1=0x270de0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1 [0158.383] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0158.383] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.384] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0158.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0158.384] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0158.510] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x7000, lpOverlapped=0x0) returned 1 [0158.524] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x7010, lpOverlapped=0x0) returned 1 [0158.526] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.588] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.604] CloseHandle (hObject=0xf4) returned 1 [0158.604] CloseHandle (hObject=0xec) returned 1 [0158.604] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.ozq0")) returned 0 [0158.605] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.ozq0")) returned 0x2020 [0158.605] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x272010, dwReserved1=0x18e974, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0x270de0 [0158.605] FindNextFileA (in: hFindFile=0x270de0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x272010, dwReserved1=0x18e974, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0158.605] FindClose (in: hFindFile=0x270de0 | out: hFindFile=0x270de0) returned 1 [0158.605] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 1 [0158.607] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 0xffffffff [0158.607] FindNextFileA (in: hFindFile=0x270eb8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cd4800, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xa800a6, dwReserved1=0x270de0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0158.607] FindClose (in: hFindFile=0x270eb8 | out: hFindFile=0x270eb8) returned 1 [0158.607] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0 [0158.607] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0158.607] FindNextFileA (in: hFindFile=0x26ed90, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0158.607] FindClose (in: hFindFile=0x26ed90 | out: hFindFile=0x26ed90) returned 1 [0158.607] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0158.608] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0158.611] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="..", cAlternateFileName="")) returned 1 [0158.611] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0158.611] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName=".", cAlternateFileName="")) returned 0x26fdf8 [0158.611] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName="..", cAlternateFileName="")) returned 1 [0158.611] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.611] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0158.612] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.612] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0158.612] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0158.613] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0158.746] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0158.747] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0158.748] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0158.810] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0158.825] CloseHandle (hObject=0xe0) returned 1 [0158.826] CloseHandle (hObject=0xec) returned 1 [0158.826] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.ozq0")) returned 0 [0158.827] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.ozq0")) returned 0x2020 [0158.827] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ee8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fd68 [0158.827] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ee8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0158.827] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0158.827] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 1 [0158.828] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0xffffffff [0158.828] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0158.828] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0158.828] FindClose (in: hFindFile=0x26fdf8 | out: hFindFile=0x26fdf8) returned 1 [0158.829] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0158.829] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fdf8 [0158.829] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0158.829] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.830] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0158.830] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0158.830] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0158.830] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0158.830] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0158.939] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0158.942] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0158.943] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.007] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.020] CloseHandle (hObject=0xec) returned 1 [0159.020] CloseHandle (hObject=0xe0) returned 1 [0159.020] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.ozq0")) returned 0 [0159.021] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.ozq0")) returned 0x2020 [0159.021] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ee8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fd68 [0159.021] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ee8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0159.021] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0159.021] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 1 [0159.022] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0xffffffff [0159.022] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0159.023] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0159.023] FindClose (in: hFindFile=0x26fdf8 | out: hFindFile=0x26fdf8) returned 1 [0159.023] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0159.023] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26fdf8 [0159.023] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0159.023] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0159.023] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0159.024] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.024] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0159.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0159.024] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0159.129] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0159.130] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0159.131] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.194] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.205] CloseHandle (hObject=0xe0) returned 1 [0159.206] CloseHandle (hObject=0xec) returned 1 [0159.206] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.ozq0")) returned 0 [0159.207] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.ozq0")) returned 0x2020 [0159.207] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ee8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fd68 [0159.207] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ee8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0159.207] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0159.207] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 1 [0159.209] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0xffffffff [0159.209] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0159.209] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0159.209] FindClose (in: hFindFile=0x26fdf8 | out: hFindFile=0x26fdf8) returned 1 [0159.209] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0159.209] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0159.210] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.210] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0159.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0159.210] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0159.329] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x43, lpOverlapped=0x0) returned 1 [0159.331] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x50, lpOverlapped=0x0) returned 1 [0159.332] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.406] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.425] CloseHandle (hObject=0xe8) returned 1 [0159.425] CloseHandle (hObject=0xec) returned 1 [0159.426] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.ozq0")) returned 0 [0159.426] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.ozq0")) returned 0x2020 [0159.426] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26fe00, dwReserved1=0x18ee44, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fdf8 [0159.426] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26fe00, dwReserved1=0x18ee44, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0159.427] FindClose (in: hFindFile=0x26fdf8 | out: hFindFile=0x26fdf8) returned 1 [0159.427] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 1 [0159.428] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0xffffffff [0159.428] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa9d0d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="index.dat", cAlternateFileName="")) returned 1 [0159.428] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.429] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0159.429] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0159.429] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0159.430] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0159.570] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x8000, lpOverlapped=0x0) returned 1 [0159.574] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x8010, lpOverlapped=0x0) returned 1 [0159.576] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.640] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.659] CloseHandle (hObject=0xec) returned 1 [0159.659] CloseHandle (hObject=0xe8) returned 1 [0159.660] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat.ozq0")) returned 0 [0159.660] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat.ozq0")) returned 0x2020 [0159.660] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa9d0d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x26fdf8, dwReserved1=0x18ee44, cFileName="index.dat", cAlternateFileName="")) returned 0x26fdf0 [0159.661] FindNextFileA (in: hFindFile=0x26fdf0, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa9d0d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x26fdf8, dwReserved1=0x18ee44, cFileName="index.dat", cAlternateFileName="")) returned 0 [0159.661] FindClose (in: hFindFile=0x26fdf0 | out: hFindFile=0x26fdf0) returned 1 [0159.661] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 1 [0159.663] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 0xffffffff [0159.663] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0159.663] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26fd68, cFileName=".", cAlternateFileName="")) returned 0x26fdf8 [0159.663] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 1 [0159.663] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x7e007c, dwReserved1=0x26fd68, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0159.664] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0159.664] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0159.664] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0159.664] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0159.665] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0159.808] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0159.809] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0159.810] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0159.872] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0159.885] CloseHandle (hObject=0xec) returned 1 [0159.885] CloseHandle (hObject=0xe0) returned 1 [0159.886] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.ozq0")) returned 0 [0159.886] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.ozq0")) returned 0x2020 [0159.886] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ee8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26fd68 [0159.886] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ee8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0159.886] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0159.887] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 1 [0159.888] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0xffffffff [0159.888] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0159.888] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0159.888] FindClose (in: hFindFile=0x26fdf8 | out: hFindFile=0x26fdf8) returned 1 [0159.888] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0159.888] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0159.888] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0159.888] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26eda8 [0159.889] FindNextFileA (in: hFindFile=0x26eda8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96e13f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0159.889] FindNextFileA (in: hFindFile=0x26eda8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff12e0f2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0159.889] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0159.889] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0159.890] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fa9 [0159.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0159.890] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0159.999] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2fa9, lpOverlapped=0x0) returned 1 [0160.018] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2fb0, lpOverlapped=0x0) returned 1 [0160.022] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.082] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.095] CloseHandle (hObject=0xe8) returned 1 [0160.096] CloseHandle (hObject=0xe0) returned 1 [0160.096] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.ozq0")) returned 0 [0160.097] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.ozq0")) returned 0x2020 [0160.097] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff12e0f2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x26fe90, dwReserved1=0x18ee44, cFileName="brndlog.bak", cAlternateFileName="")) returned 0x26ed20 [0160.097] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff12e0f2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x26fe90, dwReserved1=0x18ee44, cFileName="brndlog.bak", cAlternateFileName="")) returned 0 [0160.097] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0160.097] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 1 [0160.098] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 0xffffffff [0160.099] FindNextFileA (in: hFindFile=0x26eda8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0160.099] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0160.099] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0160.156] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fa9 [0160.156] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0160.157] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0160.242] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2fa9, lpOverlapped=0x0) returned 1 [0160.590] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2fb0, lpOverlapped=0x0) returned 1 [0160.592] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.661] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.674] CloseHandle (hObject=0xe0) returned 1 [0160.675] CloseHandle (hObject=0xe8) returned 1 [0160.676] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.ozq0")) returned 0 [0160.678] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.ozq0")) returned 0x2020 [0160.678] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x26fe90, dwReserved1=0x18ee44, cFileName="brndlog.txt", cAlternateFileName="")) returned 0x26ed20 [0160.679] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x26fe90, dwReserved1=0x18ee44, cFileName="brndlog.txt", cAlternateFileName="")) returned 0 [0160.679] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0160.679] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0160.680] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0xffffffff [0160.680] FindNextFileA (in: hFindFile=0x26eda8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="brndlog.txt", cAlternateFileName="")) returned 0 [0160.680] FindClose (in: hFindFile=0x26eda8 | out: hFindFile=0x26eda8) returned 1 [0160.680] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0160.680] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0160.696] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cd4800, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0160.696] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8679d27, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0160.696] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0160.697] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0160.697] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105000 [0160.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0160.698] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0160.739] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x105000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x105000, lpOverlapped=0x0) returned 1 [0160.832] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x105010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x105010, lpOverlapped=0x0) returned 1 [0160.859] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0160.925] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0160.937] CloseHandle (hObject=0xe8) returned 1 [0160.937] CloseHandle (hObject=0xe0) returned 1 [0160.937] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.ozq0")) returned 0 [0160.938] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.ozq0")) returned 0x2020 [0160.956] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8679d27, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x26fe18, dwReserved1=0x18ee44, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 0x26fe10 [0160.956] FindNextFileA (in: hFindFile=0x26fe10, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8679d27, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x26fe18, dwReserved1=0x18ee44, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 0 [0160.956] FindClose (in: hFindFile=0x26fe10 | out: hFindFile=0x26fe10) returned 1 [0160.957] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 1 [0160.958] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 0xffffffff [0160.958] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0160.958] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0160.958] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0160.959] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1106c [0160.959] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0160.959] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0161.002] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1106c, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1106c, lpOverlapped=0x0) returned 1 [0161.107] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x11070, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x11070, lpOverlapped=0x0) returned 1 [0161.110] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.172] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.189] CloseHandle (hObject=0xe0) returned 1 [0161.190] CloseHandle (hObject=0xe8) returned 1 [0161.190] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.ozq0")) returned 0 [0161.190] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.ozq0")) returned 0x2020 [0161.191] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x26fe08, dwReserved1=0x18ee44, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 0x26fe00 [0161.191] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cae6a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd856f385, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x26fe08, dwReserved1=0x18ee44, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 0 [0161.191] FindClose (in: hFindFile=0x26fe00 | out: hFindFile=0x26fe00) returned 1 [0161.191] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 1 [0161.193] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 0xffffffff [0161.193] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0161.193] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName=".", cAlternateFileName="")) returned 0x26fe08 [0161.193] FindNextFileA (in: hFindFile=0x26fe08, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 1 [0161.193] FindNextFileA (in: hFindFile=0x26fe08, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="en-US", cAlternateFileName="")) returned 1 [0161.194] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName=".", cAlternateFileName="")) returned 0x26fd68 [0161.194] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 1 [0161.194] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0161.194] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26fda8 [0161.210] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0161.210] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0161.210] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.211] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0161.212] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x414 [0161.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0161.212] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0161.248] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x414, lpOverlapped=0x0) returned 1 [0161.264] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x420, lpOverlapped=0x0) returned 1 [0161.265] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.324] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.338] CloseHandle (hObject=0xf4) returned 1 [0161.338] CloseHandle (hObject=0xf8) returned 1 [0161.339] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.ozq0")) returned 0 [0161.339] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.ozq0")) returned 0x2020 [0161.339] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0x272f58 [0161.339] FindNextFileA (in: hFindFile=0x272f58, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0 [0161.339] FindClose (in: hFindFile=0x272f58 | out: hFindFile=0x272f58) returned 1 [0161.339] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0161.340] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 0xffffffff [0161.340] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0161.341] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0161.341] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.341] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ff [0161.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0161.342] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0161.396] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4ff, lpOverlapped=0x0) returned 1 [0161.423] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x500, lpOverlapped=0x0) returned 1 [0161.425] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.482] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.494] CloseHandle (hObject=0xf8) returned 1 [0161.494] CloseHandle (hObject=0xf4) returned 1 [0161.495] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.ozq0")) returned 0 [0161.495] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.ozq0")) returned 0x2020 [0161.495] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x272f68, dwReserved1=0x18e70c, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0x272f60 [0161.496] FindNextFileA (in: hFindFile=0x272f60, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x272f68, dwReserved1=0x18e70c, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0 [0161.496] FindClose (in: hFindFile=0x272f60 | out: hFindFile=0x272f60) returned 1 [0161.496] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 1 [0161.497] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 0xffffffff [0161.497] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0161.497] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.498] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0161.498] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f3 [0161.498] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0161.498] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0161.537] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4f3, lpOverlapped=0x0) returned 1 [0161.621] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x500, lpOverlapped=0x0) returned 1 [0161.622] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.686] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.699] CloseHandle (hObject=0xf4) returned 1 [0161.700] CloseHandle (hObject=0xf8) returned 1 [0161.700] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.ozq0")) returned 0 [0161.700] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0161.700] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0x272f58 [0161.701] FindNextFileA (in: hFindFile=0x272f58, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0 [0161.701] FindClose (in: hFindFile=0x272f58 | out: hFindFile=0x272f58) returned 1 [0161.701] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0161.702] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0161.702] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0161.702] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0161.703] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.703] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x504 [0161.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0161.703] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0161.731] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x504, lpOverlapped=0x0) returned 1 [0161.734] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x510, lpOverlapped=0x0) returned 1 [0161.735] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.798] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.816] CloseHandle (hObject=0xf8) returned 1 [0161.817] CloseHandle (hObject=0xf4) returned 1 [0161.817] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.ozq0")) returned 0 [0161.818] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.ozq0")) returned 0x2020 [0161.818] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x272f68, dwReserved1=0x18e70c, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0x272f60 [0161.818] FindNextFileA (in: hFindFile=0x272f60, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x272f68, dwReserved1=0x18e70c, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0 [0161.818] FindClose (in: hFindFile=0x272f60 | out: hFindFile=0x272f60) returned 1 [0161.818] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 1 [0161.819] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 0xffffffff [0161.819] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0161.820] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.820] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0161.821] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31d [0161.821] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0161.821] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0161.861] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x31d, lpOverlapped=0x0) returned 1 [0161.865] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x320, lpOverlapped=0x0) returned 1 [0161.866] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0161.926] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0161.940] CloseHandle (hObject=0xf4) returned 1 [0161.940] CloseHandle (hObject=0xf8) returned 1 [0161.940] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.ozq0")) returned 0 [0161.941] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.ozq0")) returned 0x2020 [0161.941] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x272f70, dwReserved1=0x18e70c, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0x272f60 [0161.941] FindNextFileA (in: hFindFile=0x272f60, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x272f70, dwReserved1=0x18e70c, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0 [0161.941] FindClose (in: hFindFile=0x272f60 | out: hFindFile=0x272f60) returned 1 [0161.941] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0161.943] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 0xffffffff [0161.943] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0161.944] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0161.944] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0161.945] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x311 [0161.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0161.945] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0162.000] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x311, lpOverlapped=0x0) returned 1 [0162.013] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x320, lpOverlapped=0x0) returned 1 [0162.015] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.123] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.139] CloseHandle (hObject=0xf8) returned 1 [0162.140] CloseHandle (hObject=0xf4) returned 1 [0162.141] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.ozq0")) returned 0 [0162.141] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0162.141] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0x272f58 [0162.142] FindNextFileA (in: hFindFile=0x272f58, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0 [0162.142] FindClose (in: hFindFile=0x272f58 | out: hFindFile=0x272f58) returned 1 [0162.142] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0162.143] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 0xffffffff [0162.143] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0162.143] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0162.144] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0162.144] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x410 [0162.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0162.145] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0162.186] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x410, lpOverlapped=0x0) returned 1 [0162.188] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x420, lpOverlapped=0x0) returned 1 [0162.189] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.248] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.260] CloseHandle (hObject=0xf4) returned 1 [0162.260] CloseHandle (hObject=0xf8) returned 1 [0162.261] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.ozq0")) returned 0 [0162.261] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.ozq0")) returned 0x2020 [0162.261] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x272f68, dwReserved1=0x18e70c, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0x272f58 [0162.261] FindNextFileA (in: hFindFile=0x272f58, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x272f68, dwReserved1=0x18e70c, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0 [0162.261] FindClose (in: hFindFile=0x272f58 | out: hFindFile=0x272f58) returned 1 [0162.262] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0162.263] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 0xffffffff [0162.263] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0162.263] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0162.264] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0162.265] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fc [0162.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0162.265] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0162.305] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x3fc, lpOverlapped=0x0) returned 1 [0162.307] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x400, lpOverlapped=0x0) returned 1 [0162.309] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.365] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.378] CloseHandle (hObject=0xf8) returned 1 [0162.378] CloseHandle (hObject=0xf4) returned 1 [0162.379] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.ozq0")) returned 0 [0162.379] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0162.379] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0x272f58 [0162.379] FindNextFileA (in: hFindFile=0x272f58, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x272f60, dwReserved1=0x18e70c, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0 [0162.379] FindClose (in: hFindFile=0x272f58 | out: hFindFile=0x272f58) returned 1 [0162.380] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0162.381] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0162.381] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0162.381] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0162.381] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0162.382] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0162.382] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0162.382] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0162.429] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x401, lpOverlapped=0x0) returned 1 [0162.444] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x410, lpOverlapped=0x0) returned 1 [0162.445] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.506] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.521] CloseHandle (hObject=0xf4) returned 1 [0162.521] CloseHandle (hObject=0xf8) returned 1 [0162.521] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.ozq0")) returned 0 [0162.522] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.ozq0")) returned 0x2020 [0162.522] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x272f58, dwReserved1=0x18e70c, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0x272f50 [0162.522] FindNextFileA (in: hFindFile=0x272f50, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x272f58, dwReserved1=0x18e70c, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0 [0162.522] FindClose (in: hFindFile=0x272f50 | out: hFindFile=0x272f50) returned 1 [0162.522] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 1 [0162.523] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 0xffffffff [0162.523] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0162.524] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0162.524] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0162.524] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x427 [0162.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0162.525] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0162.564] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x427, lpOverlapped=0x0) returned 1 [0162.566] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x430, lpOverlapped=0x0) returned 1 [0162.577] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.639] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.652] CloseHandle (hObject=0xf8) returned 1 [0162.652] CloseHandle (hObject=0xf4) returned 1 [0162.653] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.ozq0")) returned 0 [0162.653] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.ozq0")) returned 0x2020 [0162.653] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x272f40, dwReserved1=0x18e70c, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0x272f38 [0162.654] FindNextFileA (in: hFindFile=0x272f38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x272f40, dwReserved1=0x18e70c, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0 [0162.654] FindClose (in: hFindFile=0x272f38 | out: hFindFile=0x272f38) returned 1 [0162.654] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 1 [0162.656] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 0xffffffff [0162.656] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0162.656] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0162.657] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0162.657] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x249 [0162.657] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0162.658] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0162.798] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x249, lpOverlapped=0x0) returned 1 [0162.804] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x250, lpOverlapped=0x0) returned 1 [0162.809] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0162.871] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0162.890] CloseHandle (hObject=0xf4) returned 1 [0162.891] CloseHandle (hObject=0xf8) returned 1 [0162.895] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.ozq0")) returned 0 [0162.896] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.ozq0")) returned 0x2020 [0162.896] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x272f48, dwReserved1=0x18e70c, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0x272f38 [0162.896] FindNextFileA (in: hFindFile=0x272f38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x272f48, dwReserved1=0x18e70c, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0 [0162.896] FindClose (in: hFindFile=0x272f38 | out: hFindFile=0x272f38) returned 1 [0162.896] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 1 [0162.898] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 0xffffffff [0162.898] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0162.902] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0162.902] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0162.903] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x437 [0162.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0162.903] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0162.957] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x437, lpOverlapped=0x0) returned 1 [0162.959] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x440, lpOverlapped=0x0) returned 1 [0162.960] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.023] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.039] CloseHandle (hObject=0xf8) returned 1 [0163.039] CloseHandle (hObject=0xf4) returned 1 [0163.040] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.ozq0")) returned 0 [0163.041] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.ozq0")) returned 0x2020 [0163.041] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x272f40, dwReserved1=0x18e70c, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0x272f38 [0163.041] FindNextFileA (in: hFindFile=0x272f38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x272f40, dwReserved1=0x18e70c, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0163.041] FindClose (in: hFindFile=0x272f38 | out: hFindFile=0x272f38) returned 1 [0163.041] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 1 [0163.042] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 0xffffffff [0163.043] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0163.043] FindClose (in: hFindFile=0x26fda8 | out: hFindFile=0x26fda8) returned 1 [0163.043] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cae6a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="00010C6E", cAlternateFileName="")) returned 0 [0163.043] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0163.043] FindNextFileA (in: hFindFile=0x26fe08, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="en-US", cAlternateFileName="")) returned 0 [0163.043] FindClose (in: hFindFile=0x26fe08 | out: hFindFile=0x26fe08) returned 1 [0163.043] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 0 [0163.044] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0163.044] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62737473, dwReserved1=0x3237335f, cFileName="Windows", cAlternateFileName="")) returned 1 [0163.044] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26ed98 [0163.047] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d1d5e4e, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0163.047] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Burn", cAlternateFileName="")) returned 1 [0163.047] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0163.048] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 1 [0163.048] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="Burn", cAlternateFileName="")) returned 1 [0163.048] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x270e70 [0163.048] FindNextFileA (in: hFindFile=0x270e70, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0163.049] FindNextFileA (in: hFindFile=0x270e70, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0163.049] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0163.049] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.050] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0163.050] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0163.051] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0163.098] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xae, lpOverlapped=0x0) returned 1 [0163.099] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xb0, lpOverlapped=0x0) returned 1 [0163.100] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.188] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.204] CloseHandle (hObject=0xec) returned 1 [0163.204] CloseHandle (hObject=0xf4) returned 1 [0163.204] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.ozq0")) returned 0 [0163.205] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.ozq0")) returned 0x20 [0163.205] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x271f58, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270de8 [0163.205] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x271f58, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0163.205] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0163.206] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 1 [0163.207] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0xffffffff [0163.207] FindNextFileA (in: hFindFile=0x270e70, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0163.207] FindClose (in: hFindFile=0x270e70 | out: hFindFile=0x270e70) returned 1 [0163.207] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="Burn", cAlternateFileName="")) returned 0 [0163.207] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0163.207] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Caches", cAlternateFileName="")) returned 1 [0163.207] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0163.208] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 1 [0163.208] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xeb4bd20c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 0 [0163.208] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0163.208] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Explorer", cAlternateFileName="")) returned 1 [0163.208] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0163.217] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 1 [0163.217] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4777f11, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0163.217] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0163.218] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.218] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa000 [0163.218] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0163.219] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0163.266] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xa000, lpOverlapped=0x0) returned 1 [0163.271] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa010, lpOverlapped=0x0) returned 1 [0163.273] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.342] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.355] CloseHandle (hObject=0xe0) returned 1 [0163.356] CloseHandle (hObject=0xf4) returned 1 [0163.357] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.ozq0")) returned 0 [0163.358] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.ozq0")) returned 0x2020 [0163.358] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4777f11, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 0x270e98 [0163.359] FindNextFileA (in: hFindFile=0x270e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4777f11, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 0 [0163.359] FindClose (in: hFindFile=0x270e98 | out: hFindFile=0x270e98) returned 1 [0163.359] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl")) returned 1 [0163.360] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl")) returned 0xffffffff [0163.361] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xeb8291b2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0163.361] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.361] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0163.362] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0163.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0163.363] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0163.418] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4000, lpOverlapped=0x0) returned 1 [0163.421] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4010, lpOverlapped=0x0) returned 1 [0163.422] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.483] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.496] CloseHandle (hObject=0xf4) returned 1 [0163.496] CloseHandle (hObject=0xe0) returned 1 [0163.496] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.ozq0")) returned 0 [0163.497] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.ozq0")) returned 0x2020 [0163.497] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xeb8291b2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x270eb0, dwReserved1=0x18ebdc, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 0x270ea8 [0163.497] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c88540, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c88540, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xeb8291b2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x270eb0, dwReserved1=0x18ebdc, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 0 [0163.497] FindClose (in: hFindFile=0x270ea8 | out: hFindFile=0x270ea8) returned 1 [0163.497] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl")) returned 1 [0163.498] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl")) returned 0xffffffff [0163.498] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0163.499] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0163.500] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.500] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0163.500] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0163.500] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0163.538] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0163.539] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0163.540] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.595] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.607] CloseHandle (hObject=0xe0) returned 1 [0163.607] CloseHandle (hObject=0xf4) returned 1 [0163.608] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.ozq0")) returned 0 [0163.608] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.ozq0")) returned 0x2020 [0163.608] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 0x270e90 [0163.608] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 0 [0163.608] FindClose (in: hFindFile=0x270e90 | out: hFindFile=0x270e90) returned 1 [0163.608] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 1 [0163.609] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 0xffffffff [0163.609] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 1 [0163.610] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.610] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0163.610] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0163.610] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0163.611] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0163.652] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0163.673] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0163.711] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.771] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.787] CloseHandle (hObject=0xf4) returned 1 [0163.787] CloseHandle (hObject=0xe0) returned 1 [0163.787] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.ozq0")) returned 0 [0163.788] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.ozq0")) returned 0x2020 [0163.788] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 0x270e88 [0163.788] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 0 [0163.788] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0163.788] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 1 [0163.798] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0xffffffff [0163.798] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0163.798] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0163.800] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.800] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0163.800] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0163.801] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0163.849] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0163.850] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0163.851] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0163.914] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0163.926] CloseHandle (hObject=0xe0) returned 1 [0163.927] CloseHandle (hObject=0xf4) returned 1 [0163.927] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.ozq0")) returned 0 [0163.927] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.ozq0")) returned 0x2020 [0163.927] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 0x270e88 [0163.928] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 0 [0163.928] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0163.928] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 1 [0163.929] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0xffffffff [0163.929] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0163.929] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0163.929] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0163.930] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0163.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0163.930] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0163.971] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0163.973] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0163.975] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.035] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.049] CloseHandle (hObject=0xf4) returned 1 [0164.049] CloseHandle (hObject=0xe0) returned 1 [0164.049] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.ozq0")) returned 0 [0164.050] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.ozq0")) returned 0x2020 [0164.050] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 0x270e88 [0164.050] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 0 [0164.050] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0164.050] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 1 [0164.051] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0xffffffff [0164.051] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0164.051] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0164.052] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0164.052] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb8 [0164.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0164.053] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0164.123] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xcb8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xcb8, lpOverlapped=0x0) returned 1 [0164.125] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xcc0, lpOverlapped=0x0) returned 1 [0164.127] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.183] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.195] CloseHandle (hObject=0xe0) returned 1 [0164.195] CloseHandle (hObject=0xf4) returned 1 [0164.196] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.ozq0")) returned 0 [0164.197] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.ozq0")) returned 0x2020 [0164.197] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 0x270e88 [0164.197] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 0 [0164.197] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0164.197] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 1 [0164.199] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0xffffffff [0164.199] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0164.199] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0164.199] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0164.200] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0164.200] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0164.200] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0164.289] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0164.291] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0164.292] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.349] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.363] CloseHandle (hObject=0xf4) returned 1 [0164.363] CloseHandle (hObject=0xe0) returned 1 [0164.363] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.ozq0")) returned 0 [0164.364] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.ozq0")) returned 0x2020 [0164.364] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0x270e88 [0164.364] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0 [0164.364] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0164.364] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 1 [0164.366] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0xffffffff [0164.366] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0 [0164.366] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0164.366] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0164.366] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0164.366] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0164.366] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0164.367] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0164.367] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="History", cAlternateFileName="")) returned 1 [0164.367] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0164.367] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0164.367] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0164.367] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0164.368] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0164.368] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0164.368] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0164.368] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0164.465] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x91, lpOverlapped=0x0) returned 1 [0164.466] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa0, lpOverlapped=0x0) returned 1 [0164.478] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.536] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.549] CloseHandle (hObject=0xe0) returned 1 [0164.550] CloseHandle (hObject=0xf4) returned 1 [0164.550] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.ozq0")) returned 0 [0164.550] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.ozq0")) returned 0x2020 [0164.550] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x270e88, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e80 [0164.551] FindNextFileA (in: hFindFile=0x270e80, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x270e88, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0164.551] FindClose (in: hFindFile=0x270e80 | out: hFindFile=0x270e80) returned 1 [0164.551] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 1 [0164.552] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0xffffffff [0164.552] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0164.552] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x270de8, cFileName=".", cAlternateFileName="")) returned 0x270e88 [0164.552] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e4d86f4, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x270de8, cFileName="..", cAlternateFileName="")) returned 1 [0164.552] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x8a0088, dwReserved1=0x270de8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0164.553] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0164.553] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0164.553] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0164.553] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0164.554] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0164.657] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x91, lpOverlapped=0x0) returned 1 [0164.658] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xa0, lpOverlapped=0x0) returned 1 [0164.660] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.721] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.737] CloseHandle (hObject=0xe0) returned 1 [0164.737] CloseHandle (hObject=0xec) returned 1 [0164.738] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.ozq0")) returned 0 [0164.738] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.ozq0")) returned 0x2020 [0164.738] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x271f88, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270de8 [0164.739] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x271f88, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0164.739] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0164.739] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 1 [0164.740] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0164.740] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="index.dat", cAlternateFileName="")) returned 1 [0164.740] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0164.741] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0164.741] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0164.741] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0164.742] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0164.869] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4000, lpOverlapped=0x0) returned 1 [0164.874] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4010, lpOverlapped=0x0) returned 1 [0164.875] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0164.961] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0164.974] CloseHandle (hObject=0xec) returned 1 [0164.975] CloseHandle (hObject=0xe0) returned 1 [0164.975] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.ozq0")) returned 0 [0164.976] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.ozq0")) returned 0x2020 [0164.976] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x271f80, dwReserved1=0x18e974, cFileName="index.dat", cAlternateFileName="")) returned 0x270de8 [0164.976] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x271f80, dwReserved1=0x18e974, cFileName="index.dat", cAlternateFileName="")) returned 0 [0164.976] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0164.977] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 1 [0164.978] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 0xffffffff [0164.979] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="index.dat", cAlternateFileName="")) returned 0 [0164.979] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0164.979] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0164.979] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x270e78 [0164.979] FindNextFileA (in: hFindFile=0x270e78, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0164.979] FindNextFileA (in: hFindFile=0x270e78, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 0 [0164.979] FindClose (in: hFindFile=0x270e78 | out: hFindFile=0x270e78) returned 1 [0164.980] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 0 [0164.980] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0164.980] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0164.980] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0164.980] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0164.980] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0164.980] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0164.980] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0164.980] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0164.982] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe7364c0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0164.982] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0164.982] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x270ea8 [0164.984] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0164.984] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0164.985] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0164.985] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0164.985] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0164.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0164.986] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0165.084] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x43, lpOverlapped=0x0) returned 1 [0165.085] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x50, lpOverlapped=0x0) returned 1 [0165.086] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.147] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.159] CloseHandle (hObject=0xe0) returned 1 [0165.159] CloseHandle (hObject=0xec) returned 1 [0165.159] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.ozq0")) returned 0 [0165.160] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.ozq0")) returned 0x2020 [0165.160] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x271fc8, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270de8 [0165.160] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x271fc8, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.160] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0165.160] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0165.161] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0165.161] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e3cd240, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="index.dat", cAlternateFileName="")) returned 1 [0165.161] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.162] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0165.162] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0165.162] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0165.162] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0165.269] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x8010, lpOverlapped=0x0) returned 1 [0165.271] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.329] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.351] CloseHandle (hObject=0xec) returned 1 [0165.351] CloseHandle (hObject=0xe0) returned 1 [0165.351] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.ozq0")) returned 0 [0165.352] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.ozq0")) returned 0x2020 [0165.352] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e3cd240, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x271fc8, dwReserved1=0x18e974, cFileName="index.dat", cAlternateFileName="")) returned 0x270de8 [0165.352] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e3cd240, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x271fc8, dwReserved1=0x18e974, cFileName="index.dat", cAlternateFileName="")) returned 0 [0165.352] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0165.352] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 1 [0165.355] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 0xffffffff [0165.355] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0165.355] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x271ef0, cFileName=".", cAlternateFileName="")) returned 0x270de8 [0165.355] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x271ef0, cFileName="..", cAlternateFileName="")) returned 1 [0165.355] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc000be, dwReserved1=0x271ef0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.355] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.355] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0165.356] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0165.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0165.356] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0165.468] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0165.470] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0165.471] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.542] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.554] CloseHandle (hObject=0xec) returned 1 [0165.554] CloseHandle (hObject=0xf8) returned 1 [0165.557] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.ozq0")) returned 0 [0165.558] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.ozq0")) returned 0x2020 [0165.559] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x272fe0, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e28 [0165.559] FindNextFileA (in: hFindFile=0x270e28, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x272fe0, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.559] FindClose (in: hFindFile=0x270e28 | out: hFindFile=0x270e28) returned 1 [0165.559] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 1 [0165.560] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0xffffffff [0165.560] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c623e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c623e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc000be, dwReserved1=0x271ef0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.560] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0165.561] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0165.561] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName=".", cAlternateFileName="")) returned 0x270de8 [0165.562] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="..", cAlternateFileName="")) returned 1 [0165.562] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.562] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0165.562] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.563] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0165.563] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0165.563] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0165.661] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0165.662] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0165.663] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.723] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.734] CloseHandle (hObject=0xf8) returned 1 [0165.734] CloseHandle (hObject=0xec) returned 1 [0165.735] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.ozq0")) returned 0 [0165.735] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.ozq0")) returned 0x2020 [0165.735] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x272fe0, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e28 [0165.735] FindNextFileA (in: hFindFile=0x270e28, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x272fe0, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.735] FindClose (in: hFindFile=0x270e28 | out: hFindFile=0x270e28) returned 1 [0165.735] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 1 [0165.736] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0xffffffff [0165.736] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.736] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0165.737] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0165.737] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName=".", cAlternateFileName="")) returned 0x270de8 [0165.737] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="..", cAlternateFileName="")) returned 1 [0165.737] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.737] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.738] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0165.738] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0165.738] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0165.738] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0165.832] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0165.833] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0165.834] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0165.900] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0165.912] CloseHandle (hObject=0xec) returned 1 [0165.912] CloseHandle (hObject=0xf8) returned 1 [0165.912] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.ozq0")) returned 0 [0165.913] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.ozq0")) returned 0x2020 [0165.913] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x272fe0, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e28 [0165.913] FindNextFileA (in: hFindFile=0x270e28, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x272fe0, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.913] FindClose (in: hFindFile=0x270e28 | out: hFindFile=0x270e28) returned 1 [0165.913] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 1 [0165.915] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0xffffffff [0165.915] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0165.915] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0165.915] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0165.915] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName=".", cAlternateFileName="")) returned 0x270de8 [0165.915] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="..", cAlternateFileName="")) returned 1 [0165.915] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0165.916] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0165.916] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0165.916] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0165.916] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0165.917] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0166.019] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0166.020] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0166.021] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.081] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.099] CloseHandle (hObject=0xf8) returned 1 [0166.099] CloseHandle (hObject=0xec) returned 1 [0166.099] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.ozq0")) returned 0 [0166.100] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.ozq0")) returned 0x2020 [0166.100] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x272fe0, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e28 [0166.100] FindNextFileA (in: hFindFile=0x270e28, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x272fe0, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0166.100] FindClose (in: hFindFile=0x270e28 | out: hFindFile=0x270e28) returned 1 [0166.100] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 1 [0166.101] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0xffffffff [0166.101] FindNextFileA (in: hFindFile=0x270de8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0166.101] FindClose (in: hFindFile=0x270de8 | out: hFindFile=0x270de8) returned 1 [0166.106] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0166.106] FindClose (in: hFindFile=0x270ea8 | out: hFindFile=0x270ea8) returned 1 [0166.106] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0166.106] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0166.106] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0166.107] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0166.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0166.107] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0166.214] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0166.215] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0166.217] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.275] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.289] CloseHandle (hObject=0xf4) returned 1 [0166.289] CloseHandle (hObject=0xe0) returned 1 [0166.289] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.ozq0")) returned 0 [0166.290] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.ozq0")) returned 0x2020 [0166.290] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270ea0 [0166.290] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0166.290] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0166.290] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 1 [0166.291] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0xffffffff [0166.292] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0166.292] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x270de8, cFileName=".", cAlternateFileName="")) returned 0x270e98 [0166.292] FindNextFileA (in: hFindFile=0x270e98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x270de8, cFileName="..", cAlternateFileName="")) returned 1 [0166.292] FindNextFileA (in: hFindFile=0x270e98, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x270de8, cFileName="..", cAlternateFileName="")) returned 0 [0166.292] FindClose (in: hFindFile=0x270e98 | out: hFindFile=0x270e98) returned 1 [0166.292] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0166.292] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x270de8, cFileName=".", cAlternateFileName="")) returned 0x270ea8 [0166.293] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x270de8, cFileName="..", cAlternateFileName="")) returned 1 [0166.293] FindNextFileA (in: hFindFile=0x270ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x270de8, cFileName="..", cAlternateFileName="")) returned 0 [0166.293] FindClose (in: hFindFile=0x270ea8 | out: hFindFile=0x270ea8) returned 1 [0166.293] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0166.293] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0166.293] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa4e29740, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0166.293] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0166.294] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0166.294] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40000 [0166.294] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0166.295] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0166.400] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x40000, lpOverlapped=0x0) returned 1 [0166.461] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x40010, lpOverlapped=0x0) returned 1 [0166.469] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.525] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.537] CloseHandle (hObject=0xe8) returned 1 [0166.537] CloseHandle (hObject=0xe0) returned 1 [0166.537] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.ozq0")) returned 0 [0166.538] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.ozq0")) returned 0x2020 [0166.538] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa4e29740, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="UsrClass.dat", cAlternateFileName="")) returned 0x26ed20 [0166.538] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa4e29740, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x26fe70, dwReserved1=0x18ee44, cFileName="UsrClass.dat", cAlternateFileName="")) returned 0 [0166.538] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0166.538] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 1 [0166.542] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0xffffffff [0166.542] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa4e29740, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0166.542] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0166.542] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0166.543] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb400 [0166.543] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0166.543] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0166.654] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xb400, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xb400, lpOverlapped=0x0) returned 1 [0166.659] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb410, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xb410, lpOverlapped=0x0) returned 1 [0166.661] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0166.720] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0166.732] CloseHandle (hObject=0xe0) returned 1 [0166.733] CloseHandle (hObject=0xe8) returned 1 [0166.733] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1.ozq0")) returned 0 [0166.733] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1.ozq0")) returned 0x2020 [0166.734] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa4e29740, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 0x26ed20 [0166.734] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa4e29740, ftLastWriteTime.dwHighDateTime=0x1d70554, nFileSizeHigh=0x0, nFileSizeLow=0xb400, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 0 [0166.734] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0166.734] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1")) returned 1 [0166.735] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1")) returned 0xffffffff [0166.735] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0166.735] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0166.736] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0166.736] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0166.736] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0166.736] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0166.874] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2.ozq0")) returned 0 [0166.875] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2.ozq0")) returned 0x2020 [0166.875] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 0x26ed20 [0166.875] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26fe78, dwReserved1=0x18ee44, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 0 [0166.876] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0166.876] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2")) returned 1 [0166.876] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2")) returned 0xffffffff [0166.876] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0166.877] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0166.877] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0166.878] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0166.878] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0166.878] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0167.001] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x10000, lpOverlapped=0x0) returned 1 [0167.043] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x10010, lpOverlapped=0x0) returned 1 [0167.046] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.110] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.129] CloseHandle (hObject=0xe0) returned 1 [0167.130] CloseHandle (hObject=0xe8) returned 1 [0167.130] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf.ozq0")) returned 0 [0167.131] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf.ozq0")) returned 0x2020 [0167.131] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26fec8, dwReserved1=0x18ee44, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 0x26ed20 [0167.131] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26fec8, dwReserved1=0x18ee44, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 0 [0167.131] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0167.131] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf")) returned 1 [0167.133] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf")) returned 0xffffffff [0167.133] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0167.133] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0167.133] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0167.134] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80000 [0167.134] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0167.134] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0167.174] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x80000, lpOverlapped=0x0) returned 1 [0167.186] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x80010, lpOverlapped=0x0) returned 1 [0167.200] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.254] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.267] CloseHandle (hObject=0xe8) returned 1 [0167.267] CloseHandle (hObject=0xe0) returned 1 [0167.268] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms.ozq0")) returned 0 [0167.268] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms.ozq0")) returned 0x2020 [0167.269] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26ff18, dwReserved1=0x18ee44, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 0x26ed20 [0167.269] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26ff18, dwReserved1=0x18ee44, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 0 [0167.269] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0167.269] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms")) returned 1 [0167.274] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms")) returned 0xffffffff [0167.274] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0167.274] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0167.275] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0167.275] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80000 [0167.275] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0167.275] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0167.379] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x80000, lpOverlapped=0x0) returned 1 [0167.392] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x80010, lpOverlapped=0x0) returned 1 [0167.404] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.471] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.484] CloseHandle (hObject=0xe0) returned 1 [0167.484] CloseHandle (hObject=0xe8) returned 1 [0167.485] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms.ozq0")) returned 0 [0167.485] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms.ozq0")) returned 0x2020 [0167.485] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26ff18, dwReserved1=0x18ee44, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 0x26ed20 [0167.485] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26ff18, dwReserved1=0x18ee44, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 0 [0167.486] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0167.486] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms")) returned 1 [0167.501] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms")) returned 0xffffffff [0167.501] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="WER", cAlternateFileName="")) returned 1 [0167.501] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120011e, dwReserved1=0x26fde0, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0167.502] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120011e, dwReserved1=0x26fde0, cFileName="..", cAlternateFileName="")) returned 1 [0167.502] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120011e, dwReserved1=0x26fde0, cFileName="ERC", cAlternateFileName="")) returned 1 [0167.502] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName=".", cAlternateFileName="")) returned 0x270e70 [0167.502] FindNextFileA (in: hFindFile=0x270e70, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName="..", cAlternateFileName="")) returned 1 [0167.502] FindNextFileA (in: hFindFile=0x270e70, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName="..", cAlternateFileName="")) returned 0 [0167.502] FindClose (in: hFindFile=0x270e70 | out: hFindFile=0x270e70) returned 1 [0167.502] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120011e, dwReserved1=0x26fde0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0167.502] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName=".", cAlternateFileName="")) returned 0x270e80 [0167.503] FindNextFileA (in: hFindFile=0x270e80, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName="..", cAlternateFileName="")) returned 1 [0167.503] FindNextFileA (in: hFindFile=0x270e80, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName="..", cAlternateFileName="")) returned 0 [0167.503] FindClose (in: hFindFile=0x270e80 | out: hFindFile=0x270e80) returned 1 [0167.503] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2810, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120011e, dwReserved1=0x26fde0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0167.503] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0167.503] FindNextFileA (in: hFindFile=0x26ed98, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="WER", cAlternateFileName="")) returned 0 [0167.503] FindClose (in: hFindFile=0x26ed98 | out: hFindFile=0x26ed98) returned 1 [0167.503] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66307b74, dwReserved1=0x61376436, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0167.503] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0167.506] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd774d0cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0167.506] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0167.506] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0167.506] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0167.507] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e4 [0167.507] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0167.507] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0167.613] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5e4, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x5e4, lpOverlapped=0x0) returned 1 [0167.616] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x5f0, lpOverlapped=0x0) returned 1 [0167.617] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.672] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.686] CloseHandle (hObject=0xe8) returned 1 [0167.686] CloseHandle (hObject=0xe0) returned 1 [0167.686] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ozq0")) returned 0 [0167.687] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ozq0")) returned 0x2020 [0167.687] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 0x26fe50 [0167.687] FindNextFileA (in: hFindFile=0x26fe50, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 0 [0167.687] FindClose (in: hFindFile=0x26fe50 | out: hFindFile=0x26fe50) returned 1 [0167.687] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount")) returned 1 [0167.689] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount")) returned 0xffffffff [0167.689] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0167.689] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0167.689] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0167.689] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a0 [0167.690] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0167.690] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0167.798] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2a0, lpOverlapped=0x0) returned 1 [0167.802] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2b0, lpOverlapped=0x0) returned 1 [0167.804] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0167.864] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0167.876] CloseHandle (hObject=0xe0) returned 1 [0167.876] CloseHandle (hObject=0xe8) returned 1 [0167.876] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ozq0")) returned 0 [0167.877] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ozq0")) returned 0x2020 [0167.877] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 0x26fe50 [0167.877] FindNextFileA (in: hFindFile=0x26fe50, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 0 [0167.877] FindClose (in: hFindFile=0x26fe50 | out: hFindFile=0x26fe50) returned 1 [0167.877] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount")) returned 1 [0167.878] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount")) returned 0xffffffff [0167.878] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0167.879] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0167.879] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0167.879] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c8 [0167.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0167.881] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0167.993] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x6c8, lpOverlapped=0x0) returned 1 [0168.006] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x6d0, lpOverlapped=0x0) returned 1 [0168.007] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.063] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.076] CloseHandle (hObject=0xe8) returned 1 [0168.076] CloseHandle (hObject=0xe0) returned 1 [0168.076] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ozq0")) returned 0 [0168.077] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ozq0")) returned 0x2020 [0168.077] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 0x26fe50 [0168.077] FindNextFileA (in: hFindFile=0x26fe50, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c3c280, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c3c280, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x26fe58, dwReserved1=0x18ee44, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 0 [0168.077] FindClose (in: hFindFile=0x26fe50 | out: hFindFile=0x26fe50) returned 1 [0168.077] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount")) returned 1 [0168.078] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount")) returned 0xffffffff [0168.078] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Backup", cAlternateFileName="")) returned 1 [0168.078] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc00da, dwReserved1=0x26fd68, cFileName=".", cAlternateFileName="")) returned 0x26fdf8 [0168.079] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc00da, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 1 [0168.079] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc00da, dwReserved1=0x26fd68, cFileName="new", cAlternateFileName="")) returned 1 [0168.079] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34002d, dwReserved1=0x330036, cFileName=".", cAlternateFileName="")) returned 0x26fd68 [0168.079] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34002d, dwReserved1=0x330036, cFileName="..", cAlternateFileName="")) returned 1 [0168.079] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x34002d, dwReserved1=0x330036, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0168.079] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0168.080] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.084] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0168.084] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0168.084] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0168.151] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x200000, lpOverlapped=0x0) returned 1 [0168.209] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x200010, lpOverlapped=0x0) returned 1 [0168.304] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.418] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.441] CloseHandle (hObject=0xf4) returned 1 [0168.442] CloseHandle (hObject=0xec) returned 1 [0168.443] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log.ozq0")) returned 0 [0168.444] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log.ozq0")) returned 0x2020 [0168.444] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x271ef8, dwReserved1=0x18e974, cFileName="edb00001.log", cAlternateFileName="")) returned 0x26fda8 [0168.444] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x271ef8, dwReserved1=0x18e974, cFileName="edb00001.log", cAlternateFileName="")) returned 0 [0168.444] FindClose (in: hFindFile=0x26fda8 | out: hFindFile=0x26fda8) returned 1 [0168.444] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log")) returned 1 [0168.464] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log")) returned 0xffffffff [0168.464] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0168.464] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.465] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0168.466] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x206000 [0168.466] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0168.466] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0168.590] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x206000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x206000, lpOverlapped=0x0) returned 1 [0168.653] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x206010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x206010, lpOverlapped=0x0) returned 1 [0168.719] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0168.777] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0168.793] CloseHandle (hObject=0xec) returned 1 [0168.793] CloseHandle (hObject=0xf4) returned 1 [0168.795] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore.ozq0")) returned 0 [0168.797] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore.ozq0")) returned 0x2020 [0168.797] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x271f18, dwReserved1=0x18e974, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0x26fda8 [0168.797] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x271f18, dwReserved1=0x18e974, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0 [0168.797] FindClose (in: hFindFile=0x26fda8 | out: hFindFile=0x26fda8) returned 1 [0168.797] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore")) returned 1 [0168.800] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore")) returned 0xffffffff [0168.800] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0168.800] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0168.802] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0168.802] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0168.803] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0168.803] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0168.906] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4000, lpOverlapped=0x0) returned 1 [0168.943] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4010, lpOverlapped=0x0) returned 1 [0168.945] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.002] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.021] CloseHandle (hObject=0xf4) returned 1 [0169.021] CloseHandle (hObject=0xec) returned 1 [0169.022] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat.ozq0")) returned 0 [0169.022] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat.ozq0")) returned 0x2020 [0169.022] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x271f00, dwReserved1=0x18e974, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0x26fda8 [0169.023] FindNextFileA (in: hFindFile=0x26fda8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x271f00, dwReserved1=0x18e974, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0169.023] FindClose (in: hFindFile=0x26fda8 | out: hFindFile=0x26fda8) returned 1 [0169.023] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat")) returned 1 [0169.024] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat")) returned 0xffffffff [0169.024] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0169.024] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0169.024] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc00da, dwReserved1=0x26fd68, cFileName="new", cAlternateFileName="")) returned 0 [0169.024] FindClose (in: hFindFile=0x26fdf8 | out: hFindFile=0x26fdf8) returned 1 [0169.024] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0169.024] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0169.025] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0169.025] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0169.026] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0169.026] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0169.064] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2000, lpOverlapped=0x0) returned 1 [0169.081] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2010, lpOverlapped=0x0) returned 1 [0169.083] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.143] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.158] CloseHandle (hObject=0xe0) returned 1 [0169.158] CloseHandle (hObject=0xe8) returned 1 [0169.172] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk.ozq0")) returned 0 [0169.172] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk.ozq0")) returned 0x2020 [0169.173] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x26fdf8, dwReserved1=0x18ee44, cFileName="edb.chk", cAlternateFileName="")) returned 0x26fdf0 [0169.173] FindNextFileA (in: hFindFile=0x26fdf0, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62c16120, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62c16120, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x26fdf8, dwReserved1=0x18ee44, cFileName="edb.chk", cAlternateFileName="")) returned 0 [0169.173] FindClose (in: hFindFile=0x26fdf0 | out: hFindFile=0x26fdf0) returned 1 [0169.173] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 1 [0169.174] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 0xffffffff [0169.174] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62beffc0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edb.log", cAlternateFileName="")) returned 1 [0169.174] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0169.175] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0169.175] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0169.175] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0169.176] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0169.292] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0169.535] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0169.613] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0169.696] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0169.708] CloseHandle (hObject=0xe8) returned 1 [0169.708] CloseHandle (hObject=0xe0) returned 1 [0169.709] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log.ozq0")) returned 0 [0169.709] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log.ozq0")) returned 0x2020 [0169.709] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62beffc0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26fdf8, dwReserved1=0x18ee44, cFileName="edb.log", cAlternateFileName="")) returned 0x26fdf0 [0169.709] FindNextFileA (in: hFindFile=0x26fdf0, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62beffc0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7bc3a13, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26fdf8, dwReserved1=0x18ee44, cFileName="edb.log", cAlternateFileName="")) returned 0 [0169.709] FindClose (in: hFindFile=0x26fdf0 | out: hFindFile=0x26fdf0) returned 1 [0169.709] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log")) returned 1 [0169.719] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb.log")) returned 0xffffffff [0169.719] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62beffc0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0169.719] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0169.719] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0169.720] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0169.720] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0169.720] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0169.823] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0169.941] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0169.999] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.063] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.076] CloseHandle (hObject=0xe0) returned 1 [0170.077] CloseHandle (hObject=0xe8) returned 1 [0170.077] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log.ozq0")) returned 0 [0170.077] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log.ozq0")) returned 0x2020 [0170.077] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62beffc0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26fe00, dwReserved1=0x18ee44, cFileName="edb00001.log", cAlternateFileName="")) returned 0x26fdf8 [0170.078] FindNextFileA (in: hFindFile=0x26fdf8, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62beffc0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26fe00, dwReserved1=0x18ee44, cFileName="edb00001.log", cAlternateFileName="")) returned 0 [0170.078] FindClose (in: hFindFile=0x26fdf8 | out: hFindFile=0x26fdf8) returned 1 [0170.078] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log")) returned 1 [0170.089] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edb00001.log")) returned 0xffffffff [0170.089] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0170.089] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0170.090] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.091] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0170.091] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0170.091] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0170.217] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0170.269] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0170.320] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.378] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.392] CloseHandle (hObject=0xe8) returned 1 [0170.392] CloseHandle (hObject=0xe0) returned 1 [0170.393] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.ozq0")) returned 0 [0170.393] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.ozq0")) returned 0x2020 [0170.393] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26fe08, dwReserved1=0x18ee44, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 0x26fe00 [0170.393] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26fe08, dwReserved1=0x18ee44, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 0 [0170.394] FindClose (in: hFindFile=0x26fe00 | out: hFindFile=0x26fe00) returned 1 [0170.394] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs")) returned 1 [0170.405] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs")) returned 0xffffffff [0170.405] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0170.405] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.406] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0170.406] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0170.406] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0170.407] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0170.535] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0170.610] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0170.666] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.727] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.740] CloseHandle (hObject=0xe0) returned 1 [0170.740] CloseHandle (hObject=0xe8) returned 1 [0170.741] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.ozq0")) returned 0 [0170.741] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.ozq0")) returned 0x2020 [0170.741] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26fe08, dwReserved1=0x18ee44, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 0x26fe00 [0170.741] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26fe08, dwReserved1=0x18ee44, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 0 [0170.741] FindClose (in: hFindFile=0x26fe00 | out: hFindFile=0x26fe00) returned 1 [0170.742] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs")) returned 1 [0170.752] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs")) returned 0xffffffff [0170.752] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0170.752] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0170.752] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0170.753] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0170.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0170.753] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0170.879] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x104, lpOverlapped=0x0) returned 1 [0170.880] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x110, lpOverlapped=0x0) returned 1 [0170.882] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0170.963] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0170.976] CloseHandle (hObject=0xe8) returned 1 [0170.976] CloseHandle (hObject=0xe0) returned 1 [0170.977] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml.ozq0")) returned 0 [0170.977] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml.ozq0")) returned 0x2020 [0170.978] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x26fe00, dwReserved1=0x18ee44, cFileName="oeold.xml", cAlternateFileName="")) returned 0x26fdf0 [0170.978] FindNextFileA (in: hFindFile=0x26fdf0, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x26fe00, dwReserved1=0x18ee44, cFileName="oeold.xml", cAlternateFileName="")) returned 0 [0170.978] FindClose (in: hFindFile=0x26fdf0 | out: hFindFile=0x26fdf0) returned 1 [0170.978] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml")) returned 1 [0170.979] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\oeold.xml")) returned 0xffffffff [0170.979] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0170.979] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80007e, dwReserved1=0x26fd68, cFileName=".", cAlternateFileName="")) returned 0x26fe00 [0170.982] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62beffc0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80007e, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 1 [0170.983] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x80007e, dwReserved1=0x26fd68, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0170.983] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0170.983] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0170.984] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0170.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0170.984] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0171.105] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xff, lpOverlapped=0x0) returned 1 [0171.107] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100, lpOverlapped=0x0) returned 1 [0171.109] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.167] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.180] CloseHandle (hObject=0xe8) returned 1 [0171.180] CloseHandle (hObject=0xec) returned 1 [0171.180] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.ozq0")) returned 0 [0171.181] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.ozq0")) returned 0x2020 [0171.181] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Bears.htm", cAlternateFileName="")) returned 0x26fd68 [0171.181] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Bears.htm", cAlternateFileName="")) returned 0 [0171.181] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0171.181] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm")) returned 1 [0171.182] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm")) returned 0xffffffff [0171.182] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0171.182] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0171.183] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0171.183] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x432 [0171.183] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0171.184] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0171.298] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x432, lpOverlapped=0x0) returned 1 [0171.300] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x440, lpOverlapped=0x0) returned 1 [0171.301] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.363] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.378] CloseHandle (hObject=0xec) returned 1 [0171.378] CloseHandle (hObject=0xe8) returned 1 [0171.379] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.ozq0")) returned 0 [0171.379] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.ozq0")) returned 0x2020 [0171.379] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Bears.jpg", cAlternateFileName="")) returned 0x26fd68 [0171.379] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62bc9e60, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62bc9e60, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Bears.jpg", cAlternateFileName="")) returned 0 [0171.380] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0171.380] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 1 [0171.381] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 0xffffffff [0171.381] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0171.381] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0171.382] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0171.382] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x285 [0171.382] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0171.383] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0171.493] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x285, lpOverlapped=0x0) returned 1 [0171.494] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x290, lpOverlapped=0x0) returned 1 [0171.496] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.585] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.609] CloseHandle (hObject=0xe8) returned 1 [0171.610] CloseHandle (hObject=0xec) returned 1 [0171.610] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.ozq0")) returned 0 [0171.611] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.ozq0")) returned 0x2020 [0171.611] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x26fd68 [0171.611] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0171.611] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0171.612] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 1 [0171.624] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 0xffffffff [0171.624] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0171.624] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0171.625] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0171.625] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7 [0171.625] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0171.626] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0171.807] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe7, lpOverlapped=0x0) returned 1 [0171.809] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0171.816] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0171.885] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0171.902] CloseHandle (hObject=0xec) returned 1 [0171.902] CloseHandle (hObject=0xe8) returned 1 [0171.920] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.ozq0")) returned 0 [0171.921] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.ozq0")) returned 0x2020 [0171.921] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Garden.htm", cAlternateFileName="")) returned 0x26fd68 [0171.922] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Garden.htm", cAlternateFileName="")) returned 0 [0171.922] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0171.922] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm")) returned 1 [0171.923] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm")) returned 0xffffffff [0171.923] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0171.926] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0171.927] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0171.930] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d3f [0171.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0171.930] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0172.066] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x5d3f, lpOverlapped=0x0) returned 1 [0172.068] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x5d40, lpOverlapped=0x0) returned 1 [0172.069] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.156] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.168] CloseHandle (hObject=0xe8) returned 1 [0172.168] CloseHandle (hObject=0xec) returned 1 [0172.170] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.ozq0")) returned 0 [0172.171] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.ozq0")) returned 0x2020 [0172.171] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Garden.jpg", cAlternateFileName="")) returned 0x26fd68 [0172.171] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Garden.jpg", cAlternateFileName="")) returned 0 [0172.171] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0172.171] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 1 [0172.173] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 0xffffffff [0172.173] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0172.173] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0172.173] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0172.174] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0172.174] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0172.174] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0172.276] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0172.277] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0172.279] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.344] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.356] CloseHandle (hObject=0xec) returned 1 [0172.356] CloseHandle (hObject=0xe8) returned 1 [0172.356] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.ozq0")) returned 0 [0172.357] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.ozq0")) returned 0x2020 [0172.357] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 0x26fd68 [0172.357] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 0 [0172.357] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0172.358] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm")) returned 1 [0172.359] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm")) returned 0xffffffff [0172.359] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0172.359] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0172.360] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0172.360] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1906 [0172.360] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0172.360] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0172.476] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1906, lpOverlapped=0x0) returned 1 [0172.478] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1910, lpOverlapped=0x0) returned 1 [0172.480] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.538] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.567] CloseHandle (hObject=0xe8) returned 1 [0172.567] CloseHandle (hObject=0xec) returned 1 [0172.567] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ozq0")) returned 0 [0172.568] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ozq0")) returned 0x2020 [0172.568] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0x26fd68 [0172.568] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0 [0172.568] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0172.568] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 1 [0172.569] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 0xffffffff [0172.570] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0172.570] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0172.570] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0172.571] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0172.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0172.571] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0172.702] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xeb, lpOverlapped=0x0) returned 1 [0172.703] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0172.704] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.772] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.798] CloseHandle (hObject=0xec) returned 1 [0172.799] CloseHandle (hObject=0xe8) returned 1 [0172.799] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.ozq0")) returned 0 [0172.800] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.ozq0")) returned 0x2020 [0172.800] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 0x26fd68 [0172.800] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 0 [0172.800] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0172.800] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm")) returned 1 [0172.802] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm")) returned 0xffffffff [0172.802] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0172.802] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0172.802] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0172.803] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107e [0172.803] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0172.803] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0172.912] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x107e, lpOverlapped=0x0) returned 1 [0172.920] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1080, lpOverlapped=0x0) returned 1 [0172.921] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0172.977] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0172.988] CloseHandle (hObject=0xe8) returned 1 [0172.989] CloseHandle (hObject=0xec) returned 1 [0172.989] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.ozq0")) returned 0 [0172.989] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.ozq0")) returned 0x2020 [0172.989] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0x26fd68 [0172.990] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0 [0172.990] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0172.990] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 1 [0172.991] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 0xffffffff [0172.991] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0172.991] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0172.991] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0172.992] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0172.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0172.992] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0173.114] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0173.115] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0173.116] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.182] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.194] CloseHandle (hObject=0xec) returned 1 [0173.194] CloseHandle (hObject=0xe8) returned 1 [0173.194] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.ozq0")) returned 0 [0173.195] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.ozq0")) returned 0x2020 [0173.195] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x270f08, dwReserved1=0x18ebdc, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 0x26fd68 [0173.195] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x270f08, dwReserved1=0x18ebdc, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 0 [0173.195] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0173.195] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm")) returned 1 [0173.196] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm")) returned 0xffffffff [0173.196] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0173.196] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0173.197] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0173.197] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ed [0173.197] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0173.198] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0173.299] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18ed, lpOverlapped=0x0) returned 1 [0173.301] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x18f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x18f0, lpOverlapped=0x0) returned 1 [0173.303] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.365] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.379] CloseHandle (hObject=0xe8) returned 1 [0173.379] CloseHandle (hObject=0xec) returned 1 [0173.379] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ozq0")) returned 0 [0173.380] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ozq0")) returned 0x2020 [0173.380] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0x26fd68 [0173.380] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0 [0173.380] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0173.380] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 1 [0173.381] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 0xffffffff [0173.381] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0173.381] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0173.382] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0173.382] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0173.382] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0173.382] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0173.480] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe8, lpOverlapped=0x0) returned 1 [0173.481] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0173.482] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.548] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.576] CloseHandle (hObject=0xec) returned 1 [0173.577] CloseHandle (hObject=0xe8) returned 1 [0173.577] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.ozq0")) returned 0 [0173.578] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.ozq0")) returned 0x2020 [0173.578] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Peacock.htm", cAlternateFileName="")) returned 0x26fd68 [0173.578] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Peacock.htm", cAlternateFileName="")) returned 0 [0173.578] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0173.578] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm")) returned 1 [0173.580] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm")) returned 0xffffffff [0173.580] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0173.580] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0173.581] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0173.581] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fb [0173.581] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0173.582] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0173.701] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x13fb, lpOverlapped=0x0) returned 1 [0173.705] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1400, lpOverlapped=0x0) returned 1 [0173.706] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.767] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.780] CloseHandle (hObject=0xe8) returned 1 [0173.780] CloseHandle (hObject=0xec) returned 1 [0173.781] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.ozq0")) returned 0 [0173.781] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.ozq0")) returned 0x2020 [0173.781] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0x26fd68 [0173.781] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0 [0173.781] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0173.781] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 1 [0173.782] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 0xffffffff [0173.782] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0173.783] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0173.783] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0173.783] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0173.784] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0173.784] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0173.915] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe9, lpOverlapped=0x0) returned 1 [0173.916] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0173.917] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0173.972] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0173.984] CloseHandle (hObject=0xec) returned 1 [0173.984] CloseHandle (hObject=0xe8) returned 1 [0173.985] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.ozq0")) returned 0 [0173.985] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.ozq0")) returned 0x2020 [0173.985] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Roses.htm", cAlternateFileName="")) returned 0x26fd68 [0173.985] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Roses.htm", cAlternateFileName="")) returned 0 [0173.985] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0173.986] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm")) returned 1 [0173.987] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm")) returned 0xffffffff [0173.987] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0173.987] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0173.987] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0173.988] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x780 [0173.988] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0173.988] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0174.090] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x780, lpOverlapped=0x0) returned 1 [0174.097] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x790, lpOverlapped=0x0) returned 1 [0174.099] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.171] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.185] CloseHandle (hObject=0xe8) returned 1 [0174.185] CloseHandle (hObject=0xec) returned 1 [0174.186] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.ozq0")) returned 0 [0174.186] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.ozq0")) returned 0x2020 [0174.186] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Roses.jpg", cAlternateFileName="")) returned 0x26fd68 [0174.186] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ba3d00, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ba3d00, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Roses.jpg", cAlternateFileName="")) returned 0 [0174.186] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0174.187] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 1 [0174.188] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 0xffffffff [0174.188] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0174.188] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0174.188] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0174.189] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0174.189] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0174.190] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0174.310] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0174.311] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0174.312] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0174.370] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0174.381] CloseHandle (hObject=0xec) returned 1 [0174.381] CloseHandle (hObject=0xe8) returned 1 [0174.382] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.ozq0")) returned 0 [0174.382] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.ozq0")) returned 0x2020 [0174.382] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x270f08, dwReserved1=0x18ebdc, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 0x26fd68 [0174.382] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x270f08, dwReserved1=0x18ebdc, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 0 [0174.382] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0174.383] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm")) returned 1 [0174.383] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm")) returned 0xffffffff [0174.384] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0174.384] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0174.384] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0174.385] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127e [0174.385] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0174.385] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0174.486] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x127e, lpOverlapped=0x0) returned 1 [0175.283] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1280, lpOverlapped=0x0) returned 1 [0175.284] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.346] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.383] CloseHandle (hObject=0xe8) returned 1 [0175.385] CloseHandle (hObject=0xec) returned 1 [0175.387] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ozq0")) returned 0 [0175.388] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ozq0")) returned 0x2020 [0175.388] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0x26fd68 [0175.389] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x270f00, dwReserved1=0x18ebdc, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0 [0175.389] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0175.389] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 1 [0175.390] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 0xffffffff [0175.391] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0175.391] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0175.392] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0175.392] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0175.392] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0175.393] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0175.437] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe8, lpOverlapped=0x0) returned 1 [0175.438] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0175.439] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.495] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.506] CloseHandle (hObject=0xec) returned 1 [0175.507] CloseHandle (hObject=0xe8) returned 1 [0175.507] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.ozq0")) returned 0 [0175.507] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.ozq0")) returned 0x2020 [0175.507] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 0x26fd68 [0175.508] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 0 [0175.508] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0175.508] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm")) returned 1 [0175.509] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm")) returned 0xffffffff [0175.509] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0175.509] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0175.509] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0175.510] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2949 [0175.510] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0175.510] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0175.548] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2949, lpOverlapped=0x0) returned 1 [0175.580] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2950, lpOverlapped=0x0) returned 1 [0175.581] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.654] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.726] CloseHandle (hObject=0xe8) returned 1 [0175.726] CloseHandle (hObject=0xec) returned 1 [0175.727] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.ozq0")) returned 0 [0175.727] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.ozq0")) returned 0x2020 [0175.727] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0x26fd68 [0175.727] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x270ef8, dwReserved1=0x18ebdc, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0 [0175.728] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0175.728] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 1 [0175.729] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 0xffffffff [0175.729] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0175.729] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0175.729] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0175.730] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0175.730] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0175.730] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0175.766] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe6, lpOverlapped=0x0) returned 1 [0175.767] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0175.768] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.832] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.847] CloseHandle (hObject=0xec) returned 1 [0175.847] CloseHandle (hObject=0xe8) returned 1 [0175.847] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.ozq0")) returned 0 [0175.848] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.ozq0")) returned 0x2020 [0175.848] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Stars.htm", cAlternateFileName="")) returned 0x26fd68 [0175.848] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Stars.htm", cAlternateFileName="")) returned 0 [0175.848] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0175.848] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm")) returned 1 [0175.849] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm")) returned 0xffffffff [0175.849] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0175.850] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0175.850] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0175.850] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d51 [0175.850] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0175.851] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0175.886] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1d51, lpOverlapped=0x0) returned 1 [0175.890] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d60, lpOverlapped=0x0) returned 1 [0175.891] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0175.949] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0175.960] CloseHandle (hObject=0xe8) returned 1 [0175.960] CloseHandle (hObject=0xec) returned 1 [0175.960] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.ozq0")) returned 0 [0175.961] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.ozq0")) returned 0x2020 [0175.962] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Stars.jpg", cAlternateFileName="")) returned 0x26fd68 [0175.962] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x270ef0, dwReserved1=0x18ebdc, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0175.962] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0175.962] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 1 [0175.963] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 0xffffffff [0175.963] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b7dba0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0175.963] FindClose (in: hFindFile=0x26fe00 | out: hFindFile=0x26fe00) returned 1 [0175.963] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7b05332, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x706a6d67, dwReserved1=0x766d7467, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0175.964] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0175.964] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0175.964] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x204000 [0175.964] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0175.965] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0176.011] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x204000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x204000, lpOverlapped=0x0) returned 1 [0176.137] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x204010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x204010, lpOverlapped=0x0) returned 1 [0176.199] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.255] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.267] CloseHandle (hObject=0xe0) returned 1 [0176.267] CloseHandle (hObject=0xec) returned 1 [0176.267] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.ozq0")) returned 0 [0176.268] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.ozq0")) returned 0x2020 [0176.268] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7b05332, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x26fe20, dwReserved1=0x18ee44, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0x26fe18 [0176.268] FindNextFileA (in: hFindFile=0x26fe18, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd7b05332, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x26fe20, dwReserved1=0x18ee44, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0 [0176.268] FindClose (in: hFindFile=0x26fe18 | out: hFindFile=0x26fe18) returned 1 [0176.268] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore")) returned 1 [0176.269] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore")) returned 0xffffffff [0176.269] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0176.269] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0176.270] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0176.270] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0176.270] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0176.270] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0176.313] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4000, lpOverlapped=0x0) returned 1 [0176.316] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4010, lpOverlapped=0x0) returned 1 [0176.317] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.378] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.391] CloseHandle (hObject=0xec) returned 1 [0176.391] CloseHandle (hObject=0xe0) returned 1 [0176.391] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.ozq0")) returned 0 [0176.392] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.ozq0")) returned 0x2020 [0176.392] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26fe08, dwReserved1=0x18ee44, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0x26fe00 [0176.392] FindNextFileA (in: hFindFile=0x26fe00, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26fe08, dwReserved1=0x18ee44, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0176.392] FindClose (in: hFindFile=0x26fe00 | out: hFindFile=0x26fe00) returned 1 [0176.392] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat")) returned 1 [0176.393] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat")) returned 0xffffffff [0176.393] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0176.393] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0176.393] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0176.393] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0176.394] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0176.394] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="12.0", cAlternateFileName="")) returned 1 [0176.394] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName=".", cAlternateFileName="")) returned 0x26fdf0 [0176.394] FindNextFileA (in: hFindFile=0x26fdf0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="..", cAlternateFileName="")) returned 1 [0176.394] FindNextFileA (in: hFindFile=0x26fdf0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x8c008a, dwReserved1=0x26fd68, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0176.394] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0176.395] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0176.395] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f2 [0176.395] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0176.396] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0176.434] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1f2, lpOverlapped=0x0) returned 1 [0176.435] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x200, lpOverlapped=0x0) returned 1 [0176.436] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.522] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.534] CloseHandle (hObject=0xec) returned 1 [0176.534] CloseHandle (hObject=0xe8) returned 1 [0176.534] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ozq0")) returned 0 [0176.535] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ozq0")) returned 0x2020 [0176.535] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x270ee0, dwReserved1=0x18ebdc, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 0x26fd68 [0176.535] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x270ee0, dwReserved1=0x18ebdc, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 0 [0176.535] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0176.535] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd")) returned 1 [0176.537] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd")) returned 0xffffffff [0176.537] FindNextFileA (in: hFindFile=0x26fdf0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0176.537] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0176.537] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0176.538] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27cf [0176.539] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0176.539] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0176.576] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x27cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x27cf, lpOverlapped=0x0) returned 1 [0176.670] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x27d0, lpOverlapped=0x0) returned 1 [0176.671] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.729] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.742] CloseHandle (hObject=0xe8) returned 1 [0176.742] CloseHandle (hObject=0xec) returned 1 [0176.743] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.ozq0")) returned 0 [0176.743] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.ozq0")) returned 0x2020 [0176.743] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x270ee0, dwReserved1=0x18ebdc, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0x26fd68 [0176.743] FindNextFileA (in: hFindFile=0x26fd68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x270ee0, dwReserved1=0x18ebdc, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0176.743] FindClose (in: hFindFile=0x26fd68 | out: hFindFile=0x26fd68) returned 1 [0176.743] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml")) returned 1 [0176.745] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml")) returned 0xffffffff [0176.745] FindNextFileA (in: hFindFile=0x26fdf0, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0176.745] FindClose (in: hFindFile=0x26fdf0 | out: hFindFile=0x26fdf0) returned 1 [0176.745] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="12.0", cAlternateFileName="")) returned 0 [0176.745] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0176.745] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0176.745] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26eda8 [0176.745] FindNextFileA (in: hFindFile=0x26eda8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0176.746] FindNextFileA (in: hFindFile=0x26eda8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0176.746] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed20 [0176.746] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0176.746] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0176.746] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0176.746] FindNextFileA (in: hFindFile=0x26eda8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0176.746] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0176.747] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0176.747] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54 [0176.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0176.748] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0176.785] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x54, lpOverlapped=0x0) returned 1 [0176.787] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x60, lpOverlapped=0x0) returned 1 [0176.788] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0176.848] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0176.862] CloseHandle (hObject=0xe0) returned 1 [0176.862] CloseHandle (hObject=0xec) returned 1 [0176.862] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.ozq0")) returned 0 [0176.863] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.ozq0")) returned 0x2020 [0176.863] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x26fe90, dwReserved1=0x18ee44, cFileName="Settings.ini", cAlternateFileName="")) returned 0x26ed20 [0176.863] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x26fe90, dwReserved1=0x18ee44, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0176.863] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0176.863] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1 [0176.864] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\default\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0xffffffff [0176.864] FindNextFileA (in: hFindFile=0x26eda8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0176.864] FindClose (in: hFindFile=0x26eda8 | out: hFindFile=0x26eda8) returned 1 [0176.864] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0176.864] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0176.865] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x76657265, cFileName="Temp", cAlternateFileName="")) returned 1 [0176.865] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x26cc80 [0176.865] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0176.865] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0176.865] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0176.866] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0176.866] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0176.866] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0176.866] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0176.943] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.ozq0")) returned 0 [0176.945] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.ozq0" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt.ozq0")) returned 0x2020 [0176.945] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26eda8, dwReserved1=0x18f0ac, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0x26ed20 [0176.945] FindNextFileA (in: hFindFile=0x26ed20, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26eda8, dwReserved1=0x18f0ac, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0 [0176.945] FindClose (in: hFindFile=0x26ed20 | out: hFindFile=0x26ed20) returned 1 [0176.945] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 1 [0176.945] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\default\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0xffffffff [0176.945] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0 [0176.946] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0176.946] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0176.946] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x77398c9, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="ÐÌ&")) returned 0xffffffff [0176.946] FindNextFileA (in: hFindFile=0x26ccd0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0176.946] FindClose (in: hFindFile=0x26ccd0 | out: hFindFile=0x26ccd0) returned 1 [0176.946] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0176.946] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName=".", cAlternateFileName="")) returned 0x26ccd8 [0176.947] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="..", cAlternateFileName="")) returned 1 [0176.947] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0176.947] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName=".", cAlternateFileName="")) returned 0x26cc80 [0176.947] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="..", cAlternateFileName="")) returned 1 [0176.947] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0176.947] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26edb8 [0176.947] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0176.948] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="Content", cAlternateFileName="")) returned 1 [0176.948] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0176.948] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0176.948] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0176.948] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62b318e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310066, dwReserved1=0x660066, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0176.948] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62b318e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310066, dwReserved1=0x660066, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0 [0176.948] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0176.948] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34313342, dwReserved1=0x35344532, cFileName="MetaData", cAlternateFileName="")) returned 1 [0176.948] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x320034, dwReserved1=0x340065, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0176.949] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x320034, dwReserved1=0x340065, cFileName="..", cAlternateFileName="")) returned 1 [0176.949] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62b318e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x320034, dwReserved1=0x340065, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0176.949] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62b318e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x310066, dwReserved1=0x660066, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0176.949] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x62b318e0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x310066, dwReserved1=0x660066, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 0 [0176.949] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0176.949] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34313342, dwReserved1=0x35344532, cFileName="MetaData", cAlternateFileName="")) returned 0 [0176.949] FindClose (in: hFindFile=0x26edb8 | out: hFindFile=0x26edb8) returned 1 [0176.949] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 0 [0176.949] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0176.950] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e656c69, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0176.950] FindClose (in: hFindFile=0x26ccd8 | out: hFindFile=0x26ccd8) returned 1 [0176.950] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 1 [0176.950] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68636143, dwReserved1=0x2e656c65, cFileName=".", cAlternateFileName="")) returned 0x26ccd8 [0176.950] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68636143, dwReserved1=0x2e656c65, cFileName="..", cAlternateFileName="")) returned 1 [0176.950] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68636143, dwReserved1=0x2e656c65, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0176.950] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName=".", cAlternateFileName="")) returned 0x26cc80 [0176.950] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="..", cAlternateFileName="")) returned 1 [0176.950] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0176.950] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ede0 [0176.951] FindNextFileA (in: hFindFile=0x26ede0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0176.951] FindNextFileA (in: hFindFile=0x26ede0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0176.951] FindClose (in: hFindFile=0x26ede0 | out: hFindFile=0x26ede0) returned 1 [0176.951] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0176.951] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0176.951] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0176.951] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName=".", cAlternateFileName="")) returned 0x26cc80 [0176.993] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="..", cAlternateFileName="")) returned 1 [0176.993] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0176.993] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0176.994] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0176.994] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0176.994] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0176.994] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0176.994] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26eda0 [0176.994] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0176.994] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="RSA", cAlternateFileName="")) returned 1 [0176.994] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0176.995] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0176.995] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0176.995] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0176.995] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="RSA", cAlternateFileName="")) returned 0 [0176.995] FindClose (in: hFindFile=0x26eda0 | out: hFindFile=0x26eda0) returned 1 [0176.995] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2537a0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0176.995] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26edb8 [0176.995] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0176.996] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0176.996] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0176.997] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0176.997] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de4960a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e1692f0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0176.998] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0176.998] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0176.999] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x92 [0176.999] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0176.999] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0177.047] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x92, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x92, lpOverlapped=0x0) returned 1 [0177.049] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa0, lpOverlapped=0x0) returned 1 [0177.050] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.109] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.126] CloseHandle (hObject=0xe0) returned 1 [0177.127] CloseHandle (hObject=0xe8) returned 1 [0177.127] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.ozq0")) returned 0 [0177.127] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.ozq0")) returned 0x20 [0177.128] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de4960a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e1692f0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x270ec8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26ed68 [0177.128] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7de4960a, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e1692f0, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x92, dwReserved0=0x270ec8, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0177.128] FindClose (in: hFindFile=0x26ed68 | out: hFindFile=0x26ed68) returned 1 [0177.128] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1 [0177.129] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0xffffffff [0177.129] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de234aa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0177.129] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0177.130] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0177.130] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122 [0177.130] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0177.131] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0177.172] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x122, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x122, lpOverlapped=0x0) returned 1 [0177.173] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x130, lpOverlapped=0x0) returned 1 [0177.175] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.237] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.252] CloseHandle (hObject=0xe8) returned 1 [0177.252] CloseHandle (hObject=0xe0) returned 1 [0177.253] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.ozq0")) returned 0 [0177.253] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.ozq0")) returned 0x20 [0177.253] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de234aa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x270ed8, dwReserved1=0x18ebdc, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0x26ed68 [0177.253] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de234aa, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x270ed8, dwReserved1=0x18ebdc, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0 [0177.253] FindClose (in: hFindFile=0x26ed68 | out: hFindFile=0x26ed68) returned 1 [0177.254] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0177.255] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0xffffffff [0177.255] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0177.255] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x270e08, cFileName=".", cAlternateFileName="")) returned 0x26ed68 [0177.255] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x270e08, cFileName="..", cAlternateFileName="")) returned 1 [0177.255] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x270e08, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0177.255] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName=".", cAlternateFileName="")) returned 0x271ef8 [0177.256] FindNextFileA (in: hFindFile=0x271ef8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 1 [0177.256] FindNextFileA (in: hFindFile=0x271ef8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 0 [0177.256] FindClose (in: hFindFile=0x271ef8 | out: hFindFile=0x271ef8) returned 1 [0177.256] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x270e08, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0177.256] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName=".", cAlternateFileName="")) returned 0x271ee0 [0177.335] FindNextFileA (in: hFindFile=0x271ee0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 1 [0177.335] FindNextFileA (in: hFindFile=0x271ee0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0177.335] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0177.336] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0177.336] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd3 [0177.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0177.337] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0177.380] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd3, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0xd3, lpOverlapped=0x0) returned 1 [0177.381] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0xe0, lpOverlapped=0x0) returned 1 [0177.382] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.446] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.461] CloseHandle (hObject=0xf4) returned 1 [0177.461] CloseHandle (hObject=0xf8) returned 1 [0177.462] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.ozq0")) returned 0 [0177.462] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.ozq0")) returned 0x20 [0177.463] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x273010, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x271e10 [0177.463] FindNextFileA (in: hFindFile=0x271e10, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x273010, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0177.463] FindClose (in: hFindFile=0x271e10 | out: hFindFile=0x271e10) returned 1 [0177.463] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 1 [0177.464] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 0xffffffff [0177.464] FindNextFileA (in: hFindFile=0x271ee0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0177.465] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0177.465] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0177.465] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a9 [0177.465] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0177.466] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0177.511] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x5a9, lpOverlapped=0x0) returned 1 [0177.516] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x5b0, lpOverlapped=0x0) returned 1 [0177.517] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.577] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.590] CloseHandle (hObject=0xf8) returned 1 [0177.590] CloseHandle (hObject=0xf4) returned 1 [0177.590] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.ozq0")) returned 0 [0177.591] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.ozq0")) returned 0x20 [0177.591] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x273028, dwReserved1=0x18e70c, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x271e10 [0177.591] FindNextFileA (in: hFindFile=0x271e10, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b57a40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b57a40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x273028, dwReserved1=0x18e70c, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0177.591] FindClose (in: hFindFile=0x271e10 | out: hFindFile=0x271e10) returned 1 [0177.591] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 1 [0177.592] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0xffffffff [0177.592] FindNextFileA (in: hFindFile=0x271ee0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0177.593] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0177.593] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0177.594] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0177.594] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0177.594] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0177.665] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4cc, lpOverlapped=0x0) returned 1 [0177.691] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x4d0, lpOverlapped=0x0) returned 1 [0177.693] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.748] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.761] CloseHandle (hObject=0xf4) returned 1 [0177.761] CloseHandle (hObject=0xf8) returned 1 [0177.761] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.ozq0")) returned 0 [0177.762] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.ozq0")) returned 0x20 [0177.762] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x273020, dwReserved1=0x18e70c, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x271e10 [0177.762] FindNextFileA (in: hFindFile=0x271e10, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x273020, dwReserved1=0x18e70c, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0177.762] FindClose (in: hFindFile=0x271e10 | out: hFindFile=0x271e10) returned 1 [0177.762] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 1 [0177.763] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0xffffffff [0177.763] FindNextFileA (in: hFindFile=0x271ee0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0177.764] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0177.764] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0177.764] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60b [0177.765] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0177.765] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0177.868] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x60b, lpOverlapped=0x0) returned 1 [0177.870] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x610, lpOverlapped=0x0) returned 1 [0177.871] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0177.931] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0177.944] CloseHandle (hObject=0xf8) returned 1 [0177.944] CloseHandle (hObject=0xf4) returned 1 [0177.948] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.ozq0")) returned 0 [0177.949] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.ozq0")) returned 0x20 [0177.949] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x273028, dwReserved1=0x18e70c, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x271e10 [0177.949] FindNextFileA (in: hFindFile=0x271e10, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x273028, dwReserved1=0x18e70c, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0177.949] FindClose (in: hFindFile=0x271e10 | out: hFindFile=0x271e10) returned 1 [0177.950] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 1 [0177.951] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0xffffffff [0177.951] FindNextFileA (in: hFindFile=0x271ee0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0177.951] FindClose (in: hFindFile=0x271ee0 | out: hFindFile=0x271ee0) returned 1 [0177.951] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b7dba0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x123526f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb800b6, dwReserved1=0x270e08, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0177.951] FindClose (in: hFindFile=0x26ed68 | out: hFindFile=0x26ed68) returned 1 [0177.951] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0177.951] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0177.952] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0177.952] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0177.952] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0177.953] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0178.053] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0178.054] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0178.055] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.116] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.133] CloseHandle (hObject=0xe0) returned 1 [0178.133] CloseHandle (hObject=0xe8) returned 1 [0178.134] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.ozq0")) returned 0 [0178.134] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.ozq0")) returned 0x20 [0178.135] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x270ed8, dwReserved1=0x18ebdc, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x26ed68 [0178.135] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x270ed8, dwReserved1=0x18ebdc, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0178.135] FindClose (in: hFindFile=0x26ed68 | out: hFindFile=0x26ed68) returned 1 [0178.135] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0178.136] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0xffffffff [0178.136] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de6f76b, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0178.136] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0178.137] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b318e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0 [0178.137] FindClose (in: hFindFile=0x26edb8 | out: hFindFile=0x26edb8) returned 1 [0178.137] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x2537a0, cFileName="Protect", cAlternateFileName="")) returned 1 [0178.137] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x26eda0 [0178.137] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0178.137] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf29f8e64, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0178.138] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0178.138] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0178.308] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0178.308] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0178.308] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0178.308] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0178.308] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0178.310] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 0 [0178.310] FindClose (in: hFindFile=0x26eda0 | out: hFindFile=0x26eda0) returned 1 [0178.310] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31363131, dwReserved1=0x34373533, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0178.310] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName=".", cAlternateFileName="")) returned 0x26edb8 [0178.311] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="..", cAlternateFileName="")) returned 1 [0178.311] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="My", cAlternateFileName="")) returned 1 [0178.311] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0178.311] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="..", cAlternateFileName="")) returned 1 [0178.311] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0178.311] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ed68 [0178.311] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0178.312] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0178.312] FindClose (in: hFindFile=0x26ed68 | out: hFindFile=0x26ed68) returned 1 [0178.312] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="CRLs", cAlternateFileName="")) returned 1 [0178.312] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ed68 [0178.312] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0178.312] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0178.312] FindClose (in: hFindFile=0x26ed68 | out: hFindFile=0x26ed68) returned 1 [0178.312] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="CTLs", cAlternateFileName="")) returned 1 [0178.312] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26ed68 [0178.313] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0178.313] FindNextFileA (in: hFindFile=0x26ed68, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0178.313] FindClose (in: hFindFile=0x26ed68 | out: hFindFile=0x26ed68) returned 1 [0178.313] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="CTLs", cAlternateFileName="")) returned 0 [0178.313] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0178.313] FindNextFileA (in: hFindFile=0x26edb8, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="My", cAlternateFileName="")) returned 0 [0178.313] FindClose (in: hFindFile=0x26edb8 | out: hFindFile=0x26edb8) returned 1 [0178.313] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31363131, dwReserved1=0x34373533, cFileName="Windows", cAlternateFileName="")) returned 1 [0178.313] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName=".", cAlternateFileName="")) returned 0x26eda0 [0178.331] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="..", cAlternateFileName="")) returned 1 [0178.331] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="Cookies", cAlternateFileName="")) returned 1 [0178.331] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0178.332] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe7f4ba2, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="..", cAlternateFileName="")) returned 1 [0178.332] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="index.dat", cAlternateFileName="")) returned 1 [0178.332] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0178.333] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0178.333] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0178.334] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0178.334] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0178.378] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4000, lpOverlapped=0x0) returned 1 [0178.385] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4010, lpOverlapped=0x0) returned 1 [0178.387] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.450] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.466] CloseHandle (hObject=0xe8) returned 1 [0178.467] CloseHandle (hObject=0xe0) returned 1 [0178.467] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.ozq0")) returned 0 [0178.468] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.ozq0")) returned 0x2020 [0178.468] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="index.dat", cAlternateFileName="")) returned 0x270e88 [0178.468] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="index.dat", cAlternateFileName="")) returned 0 [0178.468] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0178.468] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 1 [0178.470] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 0xffffffff [0178.470] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd021fb60, ftLastWriteTime.dwHighDateTime=0x1cb892e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="index.dat", cAlternateFileName="")) returned 0 [0178.470] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0178.471] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0178.471] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0178.471] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0178.471] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0178.471] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x270df0, cFileName=".", cAlternateFileName="")) returned 0x270e90 [0178.471] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x270df0, cFileName="..", cAlternateFileName="")) returned 1 [0178.472] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a0088, dwReserved1=0x270df0, cFileName="..", cAlternateFileName="")) returned 0 [0178.472] FindClose (in: hFindFile=0x270e90 | out: hFindFile=0x270e90) returned 1 [0178.472] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 0 [0178.472] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0178.472] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0178.472] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0178.473] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0178.473] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe6c3ce0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3c000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="index.dat", cAlternateFileName="")) returned 1 [0178.473] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0178.473] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0178.474] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c000 [0178.474] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0178.474] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0178.539] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3c000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3c000, lpOverlapped=0x0) returned 1 [0178.555] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3c010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3c010, lpOverlapped=0x0) returned 1 [0178.560] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.620] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.641] CloseHandle (hObject=0xe0) returned 1 [0178.641] CloseHandle (hObject=0xe8) returned 1 [0178.641] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.ozq0")) returned 0 [0178.642] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.ozq0")) returned 0x2020 [0178.642] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe6c3ce0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3c000, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="index.dat", cAlternateFileName="")) returned 0x270e88 [0178.642] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe6c3ce0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3c000, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="index.dat", cAlternateFileName="")) returned 0 [0178.642] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0178.642] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 1 [0178.645] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 0xffffffff [0178.645] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0178.646] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x270df0, cFileName=".", cAlternateFileName="")) returned 0x270e88 [0178.646] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x270df0, cFileName="..", cAlternateFileName="")) returned 1 [0178.646] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x270df0, cFileName="..", cAlternateFileName="")) returned 0 [0178.646] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0178.646] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 0 [0178.646] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0178.646] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3973, dwReserved1=0x2d356635, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0178.646] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0178.649] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x629dac80, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0178.649] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0178.649] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0178.649] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0178.650] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0178.650] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0178.650] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0178.751] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x112, lpOverlapped=0x0) returned 1 [0178.752] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0178.753] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0178.816] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0178.830] CloseHandle (hObject=0xe8) returned 1 [0178.831] CloseHandle (hObject=0xe0) returned 1 [0178.832] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.ozq0")) returned 0 [0178.832] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.ozq0")) returned 0x2020 [0178.833] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e90 [0178.833] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0178.833] FindClose (in: hFindFile=0x270e90 | out: hFindFile=0x270e90) returned 1 [0178.833] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 1 [0178.835] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 0xffffffff [0178.835] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xe03, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0178.835] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0178.836] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0178.836] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe03 [0178.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0178.837] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0178.945] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe03, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe03, lpOverlapped=0x0) returned 1 [0178.949] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe10, lpOverlapped=0x0) returned 1 [0178.950] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.012] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.025] CloseHandle (hObject=0xe0) returned 1 [0179.025] CloseHandle (hObject=0xe8) returned 1 [0179.025] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.ozq0")) returned 0 [0179.026] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.ozq0")) returned 0x2020 [0179.026] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xe03, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 0x270ea0 [0179.026] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xe03, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 0 [0179.026] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0179.026] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms")) returned 1 [0179.027] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms")) returned 0xffffffff [0179.027] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdd9, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0179.028] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0179.028] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0179.028] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd9 [0179.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0179.029] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0179.140] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdd9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xdd9, lpOverlapped=0x0) returned 1 [0179.143] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xde0, lpOverlapped=0x0) returned 1 [0179.144] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.209] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.226] CloseHandle (hObject=0xe8) returned 1 [0179.226] CloseHandle (hObject=0xe0) returned 1 [0179.227] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.ozq0")) returned 0 [0179.227] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.ozq0")) returned 0x2020 [0179.227] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdd9, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 0x270e98 [0179.227] FindNextFileA (in: hFindFile=0x270e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62b0b780, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdd9, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 0 [0179.227] FindClose (in: hFindFile=0x270e98 | out: hFindFile=0x270e98) returned 1 [0179.228] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms")) returned 1 [0179.228] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms")) returned 0xffffffff [0179.229] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0179.229] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0179.229] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0179.229] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdfb [0179.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0179.230] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0179.330] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdfb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xdfb, lpOverlapped=0x0) returned 1 [0179.333] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe00, lpOverlapped=0x0) returned 1 [0179.334] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.391] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.404] CloseHandle (hObject=0xe0) returned 1 [0179.404] CloseHandle (hObject=0xe8) returned 1 [0179.405] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.ozq0")) returned 0 [0179.405] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.ozq0")) returned 0x2020 [0179.405] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 0x270ea0 [0179.405] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 0 [0179.406] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0179.406] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms")) returned 1 [0179.407] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms")) returned 0xffffffff [0179.407] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0179.407] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0179.408] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0179.409] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde6 [0179.409] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0179.409] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0179.519] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xde6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xde6, lpOverlapped=0x0) returned 1 [0179.521] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xdf0, lpOverlapped=0x0) returned 1 [0179.523] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.580] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.593] CloseHandle (hObject=0xe8) returned 1 [0179.594] CloseHandle (hObject=0xe0) returned 1 [0179.594] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.ozq0")) returned 0 [0179.595] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.ozq0")) returned 0x2020 [0179.595] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0x270e98 [0179.595] FindNextFileA (in: hFindFile=0x270e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0179.595] FindClose (in: hFindFile=0x270e98 | out: hFindFile=0x270e98) returned 1 [0179.595] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms")) returned 1 [0179.597] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms")) returned 0xffffffff [0179.597] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89275ec, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xde6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0179.597] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0179.598] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0179.598] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0179.598] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0179.598] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0179.598] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0179.598] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0179.598] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0179.599] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0179.599] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda27f60, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0179.599] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0179.599] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0179.599] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0179.599] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0179.599] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0179.599] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e009c, dwReserved1=0x270df0, cFileName=".", cAlternateFileName="")) returned 0x270e80 [0179.600] FindNextFileA (in: hFindFile=0x270e80, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e009c, dwReserved1=0x270df0, cFileName="..", cAlternateFileName="")) returned 1 [0179.600] FindNextFileA (in: hFindFile=0x270e80, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e009c, dwReserved1=0x270df0, cFileName="..", cAlternateFileName="")) returned 0 [0179.600] FindClose (in: hFindFile=0x270e80 | out: hFindFile=0x270e80) returned 1 [0179.600] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 0 [0179.600] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0179.600] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Recent", cAlternateFileName="")) returned 1 [0179.600] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0179.600] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0179.600] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0179.600] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e009c, dwReserved1=0x270df0, cFileName=".", cAlternateFileName="")) returned 0x270ea0 [0179.601] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x125b3d0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9e009c, dwReserved1=0x270df0, cFileName="..", cAlternateFileName="")) returned 1 [0179.601] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x9e009c, dwReserved1=0x270df0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0179.601] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0179.601] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.605] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1600 [0179.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0179.606] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0179.711] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1600, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x1600, lpOverlapped=0x0) returned 1 [0179.725] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x1610, lpOverlapped=0x0) returned 1 [0179.726] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0179.794] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0179.809] CloseHandle (hObject=0xe8) returned 1 [0179.809] CloseHandle (hObject=0xf4) returned 1 [0179.810] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.ozq0")) returned 0 [0179.810] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.ozq0")) returned 0x20 [0179.810] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x271ff0, dwReserved1=0x18e974, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0x270df0 [0179.810] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x271ff0, dwReserved1=0x18e974, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0 [0179.811] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0179.811] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms")) returned 1 [0179.812] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms")) returned 0xffffffff [0179.812] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x14bb620, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x9e009c, dwReserved1=0x270df0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0 [0179.812] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0179.812] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x36393162, dwReserved1=0x75612e32, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0179.812] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x270ea0 [0179.815] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0179.816] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0179.816] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0179.816] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0179.817] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0179.817] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0179.817] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0179.946] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x18, lpOverlapped=0x0) returned 1 [0179.947] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x20, lpOverlapped=0x0) returned 1 [0179.948] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.015] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.033] CloseHandle (hObject=0xf4) returned 1 [0180.033] CloseHandle (hObject=0xe8) returned 1 [0180.033] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.ozq0")) returned 0 [0180.034] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.ozq0")) returned 0x20 [0180.034] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x271fe8, dwReserved1=0x18e974, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 0x270df0 [0180.034] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x271fe8, dwReserved1=0x18e974, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 0 [0180.034] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0180.034] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms")) returned 1 [0180.036] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms")) returned 0xffffffff [0180.036] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xc67cc5, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0180.036] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0180.036] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.037] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c12 [0180.037] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0180.038] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0180.155] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3c12, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x3c12, lpOverlapped=0x0) returned 1 [0180.157] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3c20, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x3c20, lpOverlapped=0x0) returned 1 [0180.159] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.215] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.230] CloseHandle (hObject=0xe8) returned 1 [0180.231] CloseHandle (hObject=0xf4) returned 1 [0180.231] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.ozq0")) returned 0 [0180.232] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.ozq0")) returned 0x20 [0180.232] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xc67cc5, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x271fe8, dwReserved1=0x18e974, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 0x270df0 [0180.232] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xc67cc5, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x3c12, dwReserved0=0x271fe8, dwReserved1=0x18e974, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 0 [0180.232] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0180.232] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms")) returned 1 [0180.234] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms")) returned 0xffffffff [0180.234] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0180.234] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0180.234] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0180.235] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0180.235] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0180.236] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0180.357] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x18, lpOverlapped=0x0) returned 1 [0180.358] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x20, lpOverlapped=0x0) returned 1 [0180.359] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.433] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.447] CloseHandle (hObject=0xf4) returned 1 [0180.447] CloseHandle (hObject=0xe8) returned 1 [0180.447] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.ozq0")) returned 0 [0180.448] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.ozq0")) returned 0x20 [0180.448] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x271fe8, dwReserved1=0x18e974, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0x270df0 [0180.448] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x271fe8, dwReserved1=0x18e974, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0 [0180.448] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0180.448] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms")) returned 1 [0180.449] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms")) returned 0xffffffff [0180.449] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x15c7376, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0 [0180.449] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0180.449] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x65333638, dwReserved1=0x75632e33, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0180.450] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0180.450] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0180.513] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b0 [0180.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0180.513] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0180.566] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1b0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0180.567] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1c0, lpOverlapped=0x0) returned 1 [0180.568] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.639] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.651] CloseHandle (hObject=0xe0) returned 1 [0180.651] CloseHandle (hObject=0xe8) returned 1 [0180.652] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.ozq0")) returned 0 [0180.652] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.ozq0")) returned 0x20 [0180.652] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e88 [0180.653] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0180.653] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0180.653] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 1 [0180.654] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 0xffffffff [0180.654] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x65333638, dwReserved1=0x75632e33, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0180.654] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0180.654] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974616e, dwReserved1=0x6f736e6f, cFileName="SendTo", cAlternateFileName="")) returned 1 [0180.654] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0180.658] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0180.659] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca9f1ef, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 1 [0180.659] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0180.659] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0180.660] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3 [0180.660] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0180.660] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0180.719] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3, lpOverlapped=0x0) returned 1 [0180.720] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x10, lpOverlapped=0x0) returned 1 [0180.721] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0180.789] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0180.804] CloseHandle (hObject=0xe8) returned 1 [0180.804] CloseHandle (hObject=0xe0) returned 1 [0180.804] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.ozq0")) returned 0 [0180.805] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget.ozq0")) returned 0x2020 [0180.805] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca9f1ef, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x270ed0, dwReserved1=0x18ebdc, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 0x270ec0 [0180.805] FindNextFileA (in: hFindFile=0x270ec0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca9f1ef, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62b0b780, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x639ff80f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3, dwReserved0=0x270ed0, dwReserved1=0x18ebdc, cFileName="Compressed (zipped) Folder.ZFSendToTarget", cAlternateFileName="COMPRE~1.ZFS")) returned 0 [0180.805] FindClose (in: hFindFile=0x270ec0 | out: hFindFile=0x270ec0) returned 1 [0180.805] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget")) returned 1 [0180.806] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Compressed (zipped) Folder.ZFSendToTarget" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\compressed (zipped) folder.zfsendtotarget")) returned 0xffffffff [0180.806] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 1 [0180.807] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0180.807] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0180.808] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7 [0180.808] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0180.808] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0180.988] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x7, lpOverlapped=0x0) returned 1 [0180.989] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x10, lpOverlapped=0x0) returned 1 [0180.991] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.071] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.093] CloseHandle (hObject=0xe0) returned 1 [0181.093] CloseHandle (hObject=0xe8) returned 1 [0181.094] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.ozq0")) returned 0 [0181.094] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink.ozq0")) returned 0x2020 [0181.094] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x270ec0, dwReserved1=0x18ebdc, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 0x270eb8 [0181.094] FindNextFileA (in: hFindFile=0x270eb8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c45a701, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3bb52ab9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7, dwReserved0=0x270ec0, dwReserved1=0x18ebdc, cFileName="Desktop (create shortcut).DeskLink", cAlternateFileName="DESKTO~1.DES")) returned 0 [0181.094] FindClose (in: hFindFile=0x270eb8 | out: hFindFile=0x270eb8) returned 1 [0181.095] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink")) returned 1 [0181.096] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop (create shortcut).DeskLink" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop (create shortcut).desklink")) returned 0xffffffff [0181.096] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0181.096] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0181.096] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0181.097] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x22e [0181.097] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0181.097] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0181.196] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x22e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x22e, lpOverlapped=0x0) returned 1 [0181.197] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x230, lpOverlapped=0x0) returned 1 [0181.198] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.261] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.273] CloseHandle (hObject=0xe8) returned 1 [0181.273] CloseHandle (hObject=0xe0) returned 1 [0181.273] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.ozq0")) returned 0 [0181.274] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini.ozq0")) returned 0x2020 [0181.274] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x270e88 [0181.274] FindNextFileA (in: hFindFile=0x270e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xec18bec6, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d828fa3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x22e, dwReserved0=0x270e90, dwReserved1=0x18ebdc, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0181.274] FindClose (in: hFindFile=0x270e88 | out: hFindFile=0x270e88) returned 1 [0181.275] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 1 [0181.276] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\desktop.ini")) returned 0xffffffff [0181.276] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cfa960, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 1 [0181.276] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0181.277] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0181.277] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0181.277] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0181.277] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0181.416] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs.ozq0")) returned 0 [0181.417] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs.ozq0")) returned 0x2020 [0181.417] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cfa960, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 0x270e90 [0181.417] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62cfa960, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9b7c855, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="Documents.mydocs", cAlternateFileName="DOCUME~1.MYD")) returned 0 [0181.417] FindClose (in: hFindFile=0x270e90 | out: hFindFile=0x270e90) returned 1 [0181.417] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs")) returned 1 [0181.418] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Documents.mydocs" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\documents.mydocs")) returned 0xffffffff [0181.418] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 1 [0181.418] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0181.419] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0181.420] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4d6 [0181.420] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0181.420] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0181.519] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4d6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4d6, lpOverlapped=0x0) returned 1 [0181.558] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e0, lpOverlapped=0x0) returned 1 [0181.559] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.616] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.627] CloseHandle (hObject=0xe8) returned 1 [0181.628] CloseHandle (hObject=0xe0) returned 1 [0181.628] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.ozq0")) returned 0 [0181.629] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk.ozq0")) returned 0x2020 [0181.629] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0x270e90 [0181.629] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d802e42, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d802e42, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x270ea0, dwReserved1=0x18ebdc, cFileName="Fax Recipient.lnk", cAlternateFileName="FAXREC~1.LNK")) returned 0 [0181.629] FindClose (in: hFindFile=0x270e90 | out: hFindFile=0x270e90) returned 1 [0181.629] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 1 [0181.630] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Fax Recipient.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\fax recipient.lnk")) returned 0xffffffff [0181.630] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 1 [0181.630] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0181.631] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0181.631] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4 [0181.631] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0181.631] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0181.669] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4, lpOverlapped=0x0) returned 1 [0181.670] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x10, lpOverlapped=0x0) returned 1 [0181.672] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.728] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.741] CloseHandle (hObject=0xe0) returned 1 [0181.741] CloseHandle (hObject=0xe8) returned 1 [0181.742] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.ozq0")) returned 0 [0181.743] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail.ozq0")) returned 0x2020 [0181.743] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0x270ea0 [0181.743] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0181.743] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0181.743] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail")) returned 1 [0181.744] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\Mail Recipient.MAPIMail" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\sendto\\mail recipient.mapimail")) returned 0xffffffff [0181.744] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c48085e, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62cfa960, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3bb9ed75, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Mail Recipient.MAPIMail", cAlternateFileName="MAILRE~1.MAP")) returned 0 [0181.744] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0181.744] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0181.744] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0181.745] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0181.745] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0181.745] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0181.745] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0181.746] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0181.746] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0181.746] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0181.840] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xae, lpOverlapped=0x0) returned 1 [0181.841] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xb0, lpOverlapped=0x0) returned 1 [0181.843] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0181.917] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0181.928] CloseHandle (hObject=0xe8) returned 1 [0181.929] CloseHandle (hObject=0xe0) returned 1 [0181.929] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.ozq0")) returned 0 [0181.930] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini.ozq0")) returned 0x20 [0181.930] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e90 [0181.930] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62ae5620, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x270e98, dwReserved1=0x18ebdc, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0181.930] FindClose (in: hFindFile=0x270e90 | out: hFindFile=0x270e90) returned 1 [0181.930] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 1 [0181.931] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\desktop.ini")) returned 0xffffffff [0181.931] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Programs", cAlternateFileName="")) returned 1 [0181.931] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x270df0, cFileName=".", cAlternateFileName="")) returned 0x270e90 [0181.940] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x270df0, cFileName="..", cAlternateFileName="")) returned 1 [0181.940] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x270df0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0181.940] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName=".", cAlternateFileName="")) returned 0x270df0 [0181.979] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="..", cAlternateFileName="")) returned 1 [0181.979] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x275fe0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0181.979] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x270e30 [0182.039] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0182.039] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0cd7f5, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0182.040] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0182.040] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0182.041] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2c0 [0182.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0182.041] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0182.088] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2c0, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x2c0, lpOverlapped=0x0) returned 1 [0182.089] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x2d0, lpOverlapped=0x0) returned 1 [0182.090] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.156] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.168] CloseHandle (hObject=0xf8) returned 1 [0182.168] CloseHandle (hObject=0x100) returned 1 [0182.169] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.ozq0")) returned 0 [0182.169] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini.ozq0")) returned 0x20 [0182.169] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0cd7f5, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x273fd0 [0182.169] FindNextFileA (in: hFindFile=0x273fd0, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0cd7f5, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b75a077, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2c0, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0182.170] FindClose (in: hFindFile=0x273fd0 | out: hFindFile=0x273fd0) returned 1 [0182.170] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 1 [0182.171] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\desktop.ini")) returned 0xffffffff [0182.171] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadace0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 1 [0182.171] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0182.171] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0182.172] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54e [0182.172] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0182.172] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0182.217] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x54e, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x54e, lpOverlapped=0x0) returned 1 [0182.283] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x550, lpOverlapped=0x0) returned 1 [0182.284] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.342] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.353] CloseHandle (hObject=0x100) returned 1 [0182.353] CloseHandle (hObject=0xf8) returned 1 [0182.354] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.ozq0")) returned 0 [0182.354] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk.ozq0")) returned 0x20 [0182.354] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadace0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x273fe8, dwReserved1=0x18e4a4, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0x273fd8 [0182.354] FindNextFileA (in: hFindFile=0x273fd8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aadace0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62ae5620, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1ab4d101, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x54e, dwReserved0=0x273fe8, dwReserved1=0x18e4a4, cFileName="Ease of Access.lnk", cAlternateFileName="EASEOF~1.LNK")) returned 0 [0182.354] FindClose (in: hFindFile=0x273fd8 | out: hFindFile=0x273fd8) returned 1 [0182.355] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 1 [0182.356] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Ease of Access.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\ease of access.lnk")) returned 0xffffffff [0182.356] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a911c5d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="Magnify.lnk", cAlternateFileName="")) returned 1 [0182.356] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0182.356] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0182.357] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ea [0182.357] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0182.357] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0182.399] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ea, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x4ea, lpOverlapped=0x0) returned 1 [0182.479] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x4f0, lpOverlapped=0x0) returned 1 [0182.480] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.544] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.555] CloseHandle (hObject=0xf8) returned 1 [0182.555] CloseHandle (hObject=0x100) returned 1 [0182.556] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.ozq0")) returned 0 [0182.556] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk.ozq0")) returned 0x20 [0182.556] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a911c5d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0x273fd0 [0182.556] FindNextFileA (in: hFindFile=0x273fd0, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a911c5d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1a98407e, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ea, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="Magnify.lnk", cAlternateFileName="")) returned 0 [0182.557] FindClose (in: hFindFile=0x273fd0 | out: hFindFile=0x273fd0) returned 1 [0182.557] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 1 [0182.558] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Magnify.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\magnify.lnk")) returned 0xffffffff [0182.558] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b733f17, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="Narrator.lnk", cAlternateFileName="")) returned 1 [0182.558] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0182.558] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0182.559] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ee [0182.559] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0182.559] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0182.602] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ee, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x4ee, lpOverlapped=0x0) returned 1 [0182.664] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x4f0, lpOverlapped=0x0) returned 1 [0182.665] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.735] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.749] CloseHandle (hObject=0x100) returned 1 [0182.750] CloseHandle (hObject=0xf8) returned 1 [0182.750] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.ozq0")) returned 0 [0182.751] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk.ozq0")) returned 0x20 [0182.751] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b733f17, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0x273fd0 [0182.751] FindNextFileA (in: hFindFile=0x273fd0, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b733f17, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b733f17, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="Narrator.lnk", cAlternateFileName="")) returned 0 [0182.751] FindClose (in: hFindFile=0x273fd0 | out: hFindFile=0x273fd0) returned 1 [0182.751] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 1 [0182.753] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Narrator.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\narrator.lnk")) returned 0xffffffff [0182.753] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 1 [0182.753] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0182.753] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0182.754] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e2 [0182.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0182.754] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0182.810] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4e2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x4e2, lpOverlapped=0x0) returned 1 [0182.889] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x4f0, lpOverlapped=0x0) returned 1 [0182.890] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0182.949] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0182.976] CloseHandle (hObject=0xf8) returned 1 [0182.976] CloseHandle (hObject=0x100) returned 1 [0182.976] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.ozq0")) returned 0 [0182.977] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk.ozq0")) returned 0x20 [0182.977] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x273ff0, dwReserved1=0x18e4a4, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0x273fe0 [0182.977] FindNextFileA (in: hFindFile=0x273fe0, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x273ff0, dwReserved1=0x18e4a4, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0182.977] FindClose (in: hFindFile=0x273fe0 | out: hFindFile=0x273fe0) returned 1 [0182.977] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 1 [0182.978] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\On-Screen Keyboard.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\accessibility\\on-screen keyboard.lnk")) returned 0xffffffff [0182.978] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a9f649f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1aa4275f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="On-Screen Keyboard.lnk", cAlternateFileName="ON-SCR~1.LNK")) returned 0 [0182.978] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0182.978] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a53d8cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x6f627965, dwReserved1=0x2e647261, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 1 [0182.978] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0182.980] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0182.980] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x500 [0182.980] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0182.981] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0183.016] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x500, lpOverlapped=0x0) returned 1 [0183.150] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x510, lpOverlapped=0x0) returned 1 [0183.151] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.212] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.224] CloseHandle (hObject=0xf4) returned 1 [0183.224] CloseHandle (hObject=0x100) returned 1 [0183.224] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.ozq0")) returned 0 [0183.225] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk.ozq0")) returned 0x20 [0183.225] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a53d8cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x272fc0, dwReserved1=0x18e70c, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0x270e30 [0183.225] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a53d8cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2a53d8cd, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x500, dwReserved0=0x272fc0, dwReserved1=0x18e70c, cFileName="Command Prompt.lnk", cAlternateFileName="COMMAN~1.LNK")) returned 0 [0183.225] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0183.225] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 1 [0183.226] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\command prompt.lnk")) returned 0xffffffff [0183.226] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0183.227] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.227] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0183.227] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a6 [0183.227] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0183.228] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0183.263] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2a6, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x2a6, lpOverlapped=0x0) returned 1 [0183.264] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x2b0, lpOverlapped=0x0) returned 1 [0183.265] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.325] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.337] CloseHandle (hObject=0x100) returned 1 [0183.338] CloseHandle (hObject=0xf4) returned 1 [0183.341] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.ozq0")) returned 0 [0183.342] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini.ozq0")) returned 0x20 [0183.342] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x272fb0, dwReserved1=0x18e70c, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x270e30 [0183.342] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d76088a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x2a6, dwReserved0=0x272fb0, dwReserved1=0x18e70c, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0183.342] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0183.342] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 1 [0183.343] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\desktop.ini")) returned 0xffffffff [0183.343] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d655ee8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Notepad.lnk", cAlternateFileName="")) returned 1 [0183.344] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0183.344] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.344] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x518 [0183.344] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0183.345] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0183.377] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x518, lpOverlapped=0x0) returned 1 [0183.498] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x520, lpOverlapped=0x0) returned 1 [0183.499] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.561] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.578] CloseHandle (hObject=0xf4) returned 1 [0183.578] CloseHandle (hObject=0x100) returned 1 [0183.579] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.ozq0")) returned 0 [0183.580] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk.ozq0")) returned 0x20 [0183.580] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d655ee8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x272fb0, dwReserved1=0x18e70c, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0x270e30 [0183.580] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d655ee8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2d73a72a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x272fb0, dwReserved1=0x18e70c, cFileName="Notepad.lnk", cAlternateFileName="")) returned 0 [0183.581] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0183.581] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 1 [0183.582] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Notepad.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\notepad.lnk")) returned 0xffffffff [0183.582] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcf29a8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Run.lnk", cAlternateFileName="")) returned 1 [0183.583] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.583] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0183.584] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0183.584] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0183.584] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0183.638] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x106, lpOverlapped=0x0) returned 1 [0183.640] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x110, lpOverlapped=0x0) returned 1 [0183.642] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.703] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.716] CloseHandle (hObject=0x100) returned 1 [0183.716] CloseHandle (hObject=0xf4) returned 1 [0183.717] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.ozq0")) returned 0 [0183.717] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk.ozq0")) returned 0x20 [0183.718] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcf29a8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x272fa8, dwReserved1=0x18e70c, cFileName="Run.lnk", cAlternateFileName="")) returned 0x270e30 [0183.718] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dcf29a8, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfec52d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x272fa8, dwReserved1=0x18e70c, cFileName="Run.lnk", cAlternateFileName="")) returned 0 [0183.718] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0183.718] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 1 [0183.719] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Run.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\run.lnk")) returned 0xffffffff [0183.720] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0183.720] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x272ee0, cFileName=".", cAlternateFileName="")) returned 0x270e30 [0183.744] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x272ee0, cFileName="..", cAlternateFileName="")) returned 1 [0183.744] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd71ea, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0xb600b4, dwReserved1=0x272ee0, cFileName="computer.lnk", cAlternateFileName="")) returned 1 [0183.744] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.745] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0183.750] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0183.750] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0183.750] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0183.805] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x106, lpOverlapped=0x0) returned 1 [0183.806] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x110, lpOverlapped=0x0) returned 1 [0183.807] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.867] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.881] CloseHandle (hObject=0x100) returned 1 [0183.881] CloseHandle (hObject=0xf8) returned 1 [0183.881] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.ozq0")) returned 0 [0183.882] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk.ozq0")) returned 0x20 [0183.882] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd71ea, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="computer.lnk", cAlternateFileName="")) returned 0x273fd0 [0183.882] FindNextFileA (in: hFindFile=0x273fd0, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ddd71ea, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e0d0d6f, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="computer.lnk", cAlternateFileName="")) returned 0 [0183.882] FindClose (in: hFindFile=0x273fd0 | out: hFindFile=0x273fd0) returned 1 [0183.882] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 1 [0183.883] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\computer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\computer.lnk")) returned 0xffffffff [0183.883] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd8af29, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 1 [0183.884] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0183.884] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.884] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0183.884] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0183.885] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0183.921] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x106, lpOverlapped=0x0) returned 1 [0183.922] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x110, lpOverlapped=0x0) returned 1 [0183.923] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0183.983] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0183.996] CloseHandle (hObject=0xf8) returned 1 [0183.997] CloseHandle (hObject=0x100) returned 1 [0183.997] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.ozq0")) returned 0 [0183.997] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk.ozq0")) returned 0x20 [0183.997] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd8af29, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x273fe0, dwReserved1=0x18e4a4, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0x273fd8 [0183.998] FindNextFileA (in: hFindFile=0x273fd8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd8af29, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e084aaf, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x273fe0, dwReserved1=0x18e4a4, cFileName="Control Panel.lnk", cAlternateFileName="CONTRO~1.LNK")) returned 0 [0183.998] FindClose (in: hFindFile=0x273fd8 | out: hFindFile=0x273fd8) returned 1 [0183.998] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 1 [0183.999] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Control Panel.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\control panel.lnk")) returned 0xffffffff [0183.999] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec119aaf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0183.999] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0183.999] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0184.000] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e2 [0184.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0184.000] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0184.044] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x2e2, lpOverlapped=0x0) returned 1 [0184.052] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x2f0, lpOverlapped=0x0) returned 1 [0184.053] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.115] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.128] CloseHandle (hObject=0x100) returned 1 [0184.128] CloseHandle (hObject=0xf8) returned 1 [0184.128] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.ozq0")) returned 0 [0184.129] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini.ozq0")) returned 0x20 [0184.129] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec119aaf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x273fc8 [0184.129] FindNextFileA (in: hFindFile=0x273fc8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec119aaf, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x273fd8, dwReserved1=0x18e4a4, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0184.129] FindClose (in: hFindFile=0x273fc8 | out: hFindFile=0x273fc8) returned 1 [0184.129] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 1 [0184.130] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\desktop.ini")) returned 0xffffffff [0184.131] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a99360, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0184.131] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0184.131] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0184.132] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5db [0184.132] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0184.132] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0184.169] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5db, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x5db, lpOverlapped=0x0) returned 1 [0184.222] WriteFile (in: hFile=0x100, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x5e0, lpOverlapped=0x0) returned 1 [0184.223] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.283] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.297] CloseHandle (hObject=0xf8) returned 1 [0184.297] CloseHandle (hObject=0x100) returned 1 [0184.297] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.ozq0")) returned 0 [0184.298] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk.ozq0")) returned 0x20 [0184.298] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a99360, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x274000, dwReserved1=0x18e4a4, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x273ff8 [0184.298] FindNextFileA (in: hFindFile=0x273ff8, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a99360, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a99360, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5db, dwReserved0=0x274000, dwReserved1=0x18e4a4, cFileName="Internet Explorer (No Add-ons).lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0184.298] FindClose (in: hFindFile=0x273ff8 | out: hFindFile=0x273ff8) returned 1 [0184.298] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 1 [0184.299] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Internet Explorer (No Add-ons).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\internet explorer (no add-ons).lnk")) returned 0xffffffff [0184.299] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 1 [0184.300] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x100 [0184.300] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0184.300] GetFileSize (in: hFile=0x100, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51a [0184.300] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0184.301] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0184.356] ReadFile (in: hFile=0x100, lpBuffer=0x299000c, nNumberOfBytesToRead=0x51a, lpNumberOfBytesRead=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e430*=0x51a, lpOverlapped=0x0) returned 1 [0184.358] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18e430, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e430*=0x520, lpOverlapped=0x0) returned 1 [0184.359] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.412] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.424] CloseHandle (hObject=0x100) returned 1 [0184.424] CloseHandle (hObject=0xf8) returned 1 [0184.425] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.ozq0")) returned 0 [0184.425] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk.ozq0")) returned 0x20 [0184.425] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk", lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x273ff8, dwReserved1=0x18e4a4, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0x273ff0 [0184.425] FindNextFileA (in: hFindFile=0x273ff0, lpFindFileData=0x18e32c | out: lpFindFileData=0x18e32c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x273ff8, dwReserved1=0x18e4a4, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0184.425] FindClose (in: hFindFile=0x273ff0 | out: hFindFile=0x273ff0) returned 1 [0184.426] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 1 [0184.427] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Private Character Editor.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\system tools\\private character editor.lnk")) returned 0xffffffff [0184.427] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d3d87bb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3d424a7b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x51a, dwReserved0=0x76f7387a, dwReserved1=0x7665359d, cFileName="Private Character Editor.lnk", cAlternateFileName="PRIVAT~1.LNK")) returned 0 [0184.427] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0184.427] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0184.427] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.427] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0184.428] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0184.428] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0184.428] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0184.465] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4cc, lpOverlapped=0x0) returned 1 [0184.474] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x4d0, lpOverlapped=0x0) returned 1 [0184.475] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.540] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.556] CloseHandle (hObject=0xf4) returned 1 [0184.556] CloseHandle (hObject=0xf8) returned 1 [0184.557] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.ozq0")) returned 0 [0184.557] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk.ozq0")) returned 0x20 [0184.558] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x272fc8, dwReserved1=0x18e70c, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x270e30 [0184.558] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x272fc8, dwReserved1=0x18e70c, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0184.558] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0184.558] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 1 [0184.559] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\accessories\\windows explorer.lnk")) returned 0xffffffff [0184.559] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dc80587, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x74636172, dwReserved1=0x45207265, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0184.559] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0184.559] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0184.559] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName=".", cAlternateFileName="")) returned 0x270df0 [0184.560] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="..", cAlternateFileName="")) returned 1 [0184.560] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0184.560] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0184.560] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.560] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0184.561] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0184.561] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0184.597] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0xae, lpOverlapped=0x0) returned 1 [0184.598] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0xb0, lpOverlapped=0x0) returned 1 [0184.599] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.661] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.677] CloseHandle (hObject=0xf8) returned 1 [0184.677] CloseHandle (hObject=0xf4) returned 1 [0184.677] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.ozq0")) returned 0 [0184.678] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini.ozq0")) returned 0x20 [0184.678] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x272fc8, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e30 [0184.678] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x272fc8, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0184.678] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0184.679] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 1 [0184.680] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\administrative tools\\desktop.ini")) returned 0xffffffff [0184.680] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0184.681] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0184.681] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x65726f6c, dwReserved1=0x6e6c2e72, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0184.681] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0184.682] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.682] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1dc [0184.682] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0184.683] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0184.745] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x1dc, lpOverlapped=0x0) returned 1 [0184.746] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x1e0, lpOverlapped=0x0) returned 1 [0184.748] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.805] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.832] CloseHandle (hObject=0xe8) returned 1 [0184.833] CloseHandle (hObject=0xf4) returned 1 [0184.833] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.ozq0")) returned 0 [0184.834] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini.ozq0")) returned 0x20 [0184.834] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x271f90, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270df0 [0184.834] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x271f90, dwReserved1=0x18e974, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0184.834] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0184.834] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 1 [0184.835] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\desktop.ini")) returned 0xffffffff [0184.835] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0184.836] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.836] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0184.836] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x587 [0184.836] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0184.837] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0184.891] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x587, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x587, lpOverlapped=0x0) returned 1 [0184.898] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x590, lpOverlapped=0x0) returned 1 [0184.899] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0184.960] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0184.973] CloseHandle (hObject=0xf4) returned 1 [0184.973] CloseHandle (hObject=0xe8) returned 1 [0184.973] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.ozq0")) returned 0 [0184.974] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk.ozq0")) returned 0x20 [0184.974] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x271fb8, dwReserved1=0x18e974, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x270df0 [0184.974] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x587, dwReserved0=0x271fb8, dwReserved1=0x18e974, cFileName="Internet Explorer (64-bit).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0184.974] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0184.974] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 1 [0184.975] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer (64-bit).lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer (64-bit).lnk")) returned 0xffffffff [0184.976] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0184.976] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0184.976] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0184.977] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a9 [0184.977] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0184.977] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0185.021] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x5a9, lpOverlapped=0x0) returned 1 [0185.026] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x5b0, lpOverlapped=0x0) returned 1 [0185.027] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.083] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.096] CloseHandle (hObject=0xe8) returned 1 [0185.097] CloseHandle (hObject=0xf4) returned 1 [0185.097] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.ozq0")) returned 0 [0185.098] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk.ozq0")) returned 0x20 [0185.098] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x271fa8, dwReserved1=0x18e974, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x270df0 [0185.098] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x271fa8, dwReserved1=0x18e974, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0185.098] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0185.098] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 1 [0185.099] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Internet Explorer.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\internet explorer.lnk")) returned 0xffffffff [0185.099] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0185.099] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba00b8, dwReserved1=0x271ed8, cFileName=".", cAlternateFileName="")) returned 0x270df0 [0185.099] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba00b8, dwReserved1=0x271ed8, cFileName="..", cAlternateFileName="")) returned 1 [0185.099] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec165d69, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0xba00b8, dwReserved1=0x271ed8, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0185.100] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0185.100] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0185.100] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13e [0185.100] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0185.101] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0185.158] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13e, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x13e, lpOverlapped=0x0) returned 1 [0185.160] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x140, lpOverlapped=0x0) returned 1 [0185.161] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.222] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.235] CloseHandle (hObject=0xe8) returned 1 [0185.236] CloseHandle (hObject=0xf8) returned 1 [0185.236] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.ozq0")) returned 0 [0185.237] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini.ozq0")) returned 0x20 [0185.237] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec165d69, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x272fb0, dwReserved1=0x18e70c, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x270e30 [0185.237] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec165d69, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e05e94e, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x272fb0, dwReserved1=0x18e70c, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0185.237] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0185.237] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 1 [0185.238] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\desktop.ini")) returned 0xffffffff [0185.238] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Help.lnk", cAlternateFileName="")) returned 1 [0185.239] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0185.239] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0185.239] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x106 [0185.239] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0185.240] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0185.274] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x106, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x106, lpOverlapped=0x0) returned 1 [0185.275] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x110, lpOverlapped=0x0) returned 1 [0185.276] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.337] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.348] CloseHandle (hObject=0xf8) returned 1 [0185.349] CloseHandle (hObject=0xe8) returned 1 [0185.349] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.ozq0")) returned 0 [0185.350] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk.ozq0")) returned 0x20 [0185.350] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x272fb0, dwReserved1=0x18e70c, cFileName="Help.lnk", cAlternateFileName="")) returned 0x270e30 [0185.350] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x272fb0, dwReserved1=0x18e70c, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0185.350] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0185.350] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 1 [0185.351] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Help.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\maintenance\\help.lnk")) returned 0xffffffff [0185.351] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd3ec69, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x62a73200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e0387ee, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x106, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Help.lnk", cAlternateFileName="")) returned 0 [0185.351] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0185.351] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x83e, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Microsoft OneDrive.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0185.351] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft OneDrive.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\microsoft onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.353] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft OneDrive.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\microsoft onedrive.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0185.353] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x83e [0185.353] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0185.353] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0185.389] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x83e, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x83e, lpOverlapped=0x0) returned 1 [0185.439] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x840, lpOverlapped=0x0) returned 1 [0185.440] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.494] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.507] CloseHandle (hObject=0xf4) returned 1 [0185.507] CloseHandle (hObject=0xe8) returned 1 [0185.508] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft OneDrive.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\microsoft onedrive.lnk"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft OneDrive.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\microsoft onedrive.lnk.ozq0")) returned 0 [0185.508] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft OneDrive.lnk.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\microsoft onedrive.lnk.ozq0")) returned 0x20 [0185.508] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft OneDrive.lnk", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x83e, dwReserved0=0x271fa8, dwReserved1=0x18e974, cFileName="Microsoft OneDrive.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0x270df0 [0185.508] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x83e, dwReserved0=0x271fa8, dwReserved1=0x18e974, cFileName="Microsoft OneDrive.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0185.509] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0185.509] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft OneDrive.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\microsoft onedrive.lnk")) returned 1 [0185.510] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft OneDrive.lnk" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\microsoft onedrive.lnk")) returned 0xffffffff [0185.511] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Startup", cAlternateFileName="")) returned 1 [0185.511] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x271ed8, cFileName=".", cAlternateFileName="")) returned 0x270df0 [0185.511] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x271ed8, cFileName="..", cAlternateFileName="")) returned 1 [0185.511] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xbc00ba, dwReserved1=0x271ed8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0185.511] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0185.511] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0185.512] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0185.512] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0185.512] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0185.558] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0xae, lpOverlapped=0x0) returned 1 [0185.559] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0xb0, lpOverlapped=0x0) returned 1 [0185.560] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.621] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.636] CloseHandle (hObject=0xf4) returned 1 [0185.637] CloseHandle (hObject=0xf8) returned 1 [0185.637] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.ozq0")) returned 0 [0185.638] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini.ozq0")) returned 0x20 [0185.638] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x272fa8, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x270e30 [0185.638] FindNextFileA (in: hFindFile=0x270e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x272fa8, dwReserved1=0x18e70c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0185.638] FindClose (in: hFindFile=0x270e30 | out: hFindFile=0x270e30) returned 1 [0185.638] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 1 [0185.639] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini")) returned 0xffffffff [0185.639] FindNextFileA (in: hFindFile=0x270df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xbc00ba, dwReserved1=0x271ed8, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0185.639] FindClose (in: hFindFile=0x270df0 | out: hFindFile=0x270df0) returned 1 [0185.639] FindNextFileA (in: hFindFile=0x270e90, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="Startup", cAlternateFileName="")) returned 0 [0185.639] FindClose (in: hFindFile=0x270e90 | out: hFindFile=0x270e90) returned 1 [0185.639] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Programs", cAlternateFileName="")) returned 0 [0185.640] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0185.640] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0185.640] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7244656e, dwReserved1=0x2e657669, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0185.640] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7244656e, dwReserved1=0x2e657669, cFileName="..", cAlternateFileName="")) returned 1 [0185.640] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda4e0ba, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaef15879, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7244656e, dwReserved1=0x2e657669, cFileName="..", cAlternateFileName="")) returned 0 [0185.640] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0185.640] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 1 [0185.640] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7244656e, dwReserved1=0x2e657669, cFileName=".", cAlternateFileName="")) returned 0x26ed28 [0185.640] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7244656e, dwReserved1=0x2e657669, cFileName="..", cAlternateFileName="")) returned 1 [0185.641] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x7244656e, dwReserved1=0x2e657669, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 1 [0185.641] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0185.641] CreateFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0185.641] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9b944 [0185.642] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0185.642] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0185.687] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9b944, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9b944, lpOverlapped=0x0) returned 1 [0185.794] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9b950, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9b950, lpOverlapped=0x0) returned 1 [0185.807] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0185.873] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0185.886] CloseHandle (hObject=0xe0) returned 1 [0185.886] CloseHandle (hObject=0xe8) returned 1 [0185.887] MoveFileA (lpExistingFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg"), lpNewFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.ozq0")) returned 0 [0185.887] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg.ozq0" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg.ozq0")) returned 0x2020 [0185.887] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0x270ea0 [0185.887] FindNextFileA (in: hFindFile=0x270ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x270ea8, dwReserved1=0x18ebdc, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0185.887] FindClose (in: hFindFile=0x270ea0 | out: hFindFile=0x270ea0) returned 1 [0185.888] DeleteFileA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 1 [0185.894] GetFileAttributesA (lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg" (normalized: "c:\\users\\default\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper.jpg")) returned 0xffffffff [0185.894] FindNextFileA (in: hFindFile=0x26ed28, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff982e02, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x9b944, dwReserved0=0x7244656e, dwReserved1=0x2e657669, cFileName="TranscodedWallpaper.jpg", cAlternateFileName="TRANSC~1.JPG")) returned 0 [0185.894] FindClose (in: hFindFile=0x26ed28 | out: hFindFile=0x26ed28) returned 1 [0185.894] FindNextFileA (in: hFindFile=0x26eda0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xef632f84, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e746e65, dwReserved1=0x4950414d, cFileName="Themes", cAlternateFileName="")) returned 0 [0185.894] FindClose (in: hFindFile=0x26eda0 | out: hFindFile=0x26eda0) returned 1 [0185.894] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x31363131, dwReserved1=0x34373533, cFileName="Windows", cAlternateFileName="")) returned 0 [0185.894] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0185.894] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0185.894] FindClose (in: hFindFile=0x26ccd8 | out: hFindFile=0x26ccd8) returned 1 [0185.894] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 0 [0185.895] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0185.895] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6d2e6d6f, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0185.895] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Application Data\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x629dac80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="ð«&")) returned 0xffffffff [0185.895] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6d2e6d6f, cFileName="Contacts", cAlternateFileName="")) returned 1 [0185.895] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Contacts\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0185.895] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="..", cAlternateFileName="")) returned 1 [0185.895] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x7265746e, dwReserved1=0x2074656e, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0185.896] CreateFileA (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0185.896] CreateFileA (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact.ozq0" (normalized: "c:\\users\\default\\contacts\\administrator.contact.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0185.896] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b1e [0185.896] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0185.897] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0185.936] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10b1e, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x10b1e, lpOverlapped=0x0) returned 1 [0186.097] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10b20, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x10b20, lpOverlapped=0x0) returned 1 [0186.099] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.156] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.168] CloseHandle (hObject=0xe4) returned 1 [0186.168] CloseHandle (hObject=0xf0) returned 1 [0186.169] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), lpNewFileName="C:\\Users\\Default\\Contacts\\Administrator.contact.ozq0" (normalized: "c:\\users\\default\\contacts\\administrator.contact.ozq0")) returned 0 [0186.169] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact.ozq0" (normalized: "c:\\users\\default\\contacts\\administrator.contact.ozq0")) returned 0x20 [0186.169] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x26ccf8, dwReserved1=0x18f57c, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 0x26cce8 [0186.169] FindNextFileA (in: hFindFile=0x26cce8, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x26ccf8, dwReserved1=0x18f57c, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 0 [0186.169] FindClose (in: hFindFile=0x26cce8 | out: hFindFile=0x26cce8) returned 1 [0186.170] DeleteFileA (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact")) returned 1 [0186.171] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact")) returned 0xffffffff [0186.171] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0186.171] CreateFileA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.172] CreateFileA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\contacts\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0186.172] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19c [0186.172] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0186.173] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0186.229] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x19c, lpOverlapped=0x0) returned 1 [0186.231] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x1a0, lpOverlapped=0x0) returned 1 [0186.232] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.290] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.301] CloseHandle (hObject=0xf0) returned 1 [0186.302] CloseHandle (hObject=0xe4) returned 1 [0186.302] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Contacts\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\contacts\\desktop.ini.ozq0")) returned 0 [0186.303] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\contacts\\desktop.ini.ozq0")) returned 0x20 [0186.303] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26ccd8 [0186.303] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.303] FindClose (in: hFindFile=0x26ccd8 | out: hFindFile=0x26ccd8) returned 1 [0186.303] DeleteFileA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini")) returned 1 [0186.304] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Contacts\\desktop.ini" (normalized: "c:\\users\\default\\contacts\\desktop.ini")) returned 0xffffffff [0186.304] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.304] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0186.304] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Cookies", cAlternateFileName="")) returned 1 [0186.304] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Cookies\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="ð«&")) returned 0xffffffff [0186.304] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Desktop", cAlternateFileName="")) returned 1 [0186.304] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Desktop\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0186.305] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0186.305] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0186.305] CreateFileA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0186.305] CreateFileA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\desktop\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.306] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0186.306] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0186.306] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0186.343] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x11a, lpOverlapped=0x0) returned 1 [0186.344] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x120, lpOverlapped=0x0) returned 1 [0186.345] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.408] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.420] CloseHandle (hObject=0xe4) returned 1 [0186.420] CloseHandle (hObject=0xf0) returned 1 [0186.421] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Desktop\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\desktop\\desktop.ini.ozq0")) returned 0 [0186.421] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\desktop\\desktop.ini.ozq0")) returned 0x20 [0186.421] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26ccd8 [0186.421] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.421] FindClose (in: hFindFile=0x26ccd8 | out: hFindFile=0x26ccd8) returned 1 [0186.422] DeleteFileA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini")) returned 1 [0186.423] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Desktop\\desktop.ini" (normalized: "c:\\users\\default\\desktop\\desktop.ini")) returned 0xffffffff [0186.423] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.423] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0186.423] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0186.423] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0186.424] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0186.424] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0186.424] CreateFileA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.424] CreateFileA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\documents\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0186.425] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192 [0186.425] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0186.425] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0186.461] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x192, lpOverlapped=0x0) returned 1 [0186.462] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x1a0, lpOverlapped=0x0) returned 1 [0186.463] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.520] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.531] CloseHandle (hObject=0xf0) returned 1 [0186.532] CloseHandle (hObject=0xe4) returned 1 [0186.532] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Documents\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\documents\\desktop.ini.ozq0")) returned 0 [0186.532] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\documents\\desktop.ini.ozq0")) returned 0x20 [0186.532] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26ccd8 [0186.533] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.533] FindClose (in: hFindFile=0x26ccd8 | out: hFindFile=0x26ccd8) returned 1 [0186.533] DeleteFileA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini")) returned 1 [0186.534] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Documents\\desktop.ini" (normalized: "c:\\users\\default\\documents\\desktop.ini")) returned 0xffffffff [0186.534] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766524b5, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0186.534] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x18f568, ftCreationTime.dwLowDateTime=0x1c41a58, ftCreationTime.dwHighDateTime=0x26cc78, ftLastAccessTime.dwLowDateTime=0x18f548, ftLastAccessTime.dwHighDateTime=0x76f6e688, ftLastWriteTime.dwLowDateTime=0x250000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x26cc80, nFileSizeLow=0x18f558, dwReserved0=0x76f6e65f, dwReserved1=0x26cc80, cFileName="Ð\x18Ä\x01põ\x18", cAlternateFileName="8¼&")) returned 0xffffffff [0186.534] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766524b5, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0186.534] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x18f568, ftCreationTime.dwLowDateTime=0x1c41a58, ftCreationTime.dwHighDateTime=0x26cc78, ftLastAccessTime.dwLowDateTime=0x18f548, ftLastAccessTime.dwHighDateTime=0x76f6e688, ftLastWriteTime.dwLowDateTime=0x250000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x26cc80, nFileSizeLow=0x18f558, dwReserved0=0x76f6e65f, dwReserved1=0x26cc80, cFileName="Ð\x18Ä\x01põ\x18", cAlternateFileName="8¼&")) returned 0xffffffff [0186.534] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766524b5, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0186.534] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x18f568, ftCreationTime.dwLowDateTime=0x1c41a58, ftCreationTime.dwHighDateTime=0x26cc78, ftLastAccessTime.dwLowDateTime=0x18f548, ftLastAccessTime.dwHighDateTime=0x76f6e688, ftLastWriteTime.dwLowDateTime=0x250000, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x26cc80, nFileSizeLow=0x18f558, dwReserved0=0x76f6e65f, dwReserved1=0x26cc80, cFileName="Ð\x18Ä\x01põ\x18", cAlternateFileName="8¼&")) returned 0xffffffff [0186.534] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766524b5, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0186.534] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0186.534] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0186.534] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Downloads\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0186.535] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0186.535] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0186.535] CreateFileA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0186.535] CreateFileA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\downloads\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.536] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0186.536] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0186.536] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0186.572] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x11a, lpOverlapped=0x0) returned 1 [0186.573] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x120, lpOverlapped=0x0) returned 1 [0186.574] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.638] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.651] CloseHandle (hObject=0xe4) returned 1 [0186.651] CloseHandle (hObject=0xf0) returned 1 [0186.651] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Downloads\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\downloads\\desktop.ini.ozq0")) returned 0 [0186.652] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\downloads\\desktop.ini.ozq0")) returned 0x20 [0186.652] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26ccd8 [0186.652] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.652] FindClose (in: hFindFile=0x26ccd8 | out: hFindFile=0x26ccd8) returned 1 [0186.652] DeleteFileA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini")) returned 1 [0186.653] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Downloads\\desktop.ini" (normalized: "c:\\users\\default\\downloads\\desktop.ini")) returned 0xffffffff [0186.653] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0xa0000003, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.653] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0186.653] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x61746e6f, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0186.653] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26bc38 [0186.668] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0186.668] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0186.669] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.669] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\favorites\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0186.670] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x192 [0186.670] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0186.670] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0186.702] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x192, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x192, lpOverlapped=0x0) returned 1 [0186.703] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x1a0, lpOverlapped=0x0) returned 1 [0186.704] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.765] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.777] CloseHandle (hObject=0xf0) returned 1 [0186.777] CloseHandle (hObject=0xe4) returned 1 [0186.778] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Favorites\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\favorites\\desktop.ini.ozq0")) returned 0 [0186.778] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\favorites\\desktop.ini.ozq0")) returned 0x20 [0186.778] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26ccd8 [0186.779] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x26cce0, dwReserved1=0x18f57c, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.779] FindClose (in: hFindFile=0x26ccd8 | out: hFindFile=0x26ccd8) returned 1 [0186.779] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini")) returned 1 [0186.780] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\desktop.ini")) returned 0xffffffff [0186.780] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Links", cAlternateFileName="")) returned 1 [0186.780] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e004c, dwReserved1=0x26cc80, cFileName=".", cAlternateFileName="")) returned 0x26ccd8 [0186.780] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4e004c, dwReserved1=0x26cc80, cFileName="..", cAlternateFileName="")) returned 1 [0186.780] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x4e004c, dwReserved1=0x26cc80, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0186.780] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.781] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0186.781] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x50 [0186.781] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0186.781] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0186.822] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x50, lpOverlapped=0x0) returned 1 [0186.823] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x60, lpOverlapped=0x0) returned 1 [0186.824] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0186.895] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0186.907] CloseHandle (hObject=0xf0) returned 1 [0186.907] CloseHandle (hObject=0xec) returned 1 [0186.907] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini.ozq0")) returned 0 [0186.908] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini.ozq0")) returned 0x20 [0186.908] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x26dd90, dwReserved1=0x18f314, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26cc80 [0186.908] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x26dd90, dwReserved1=0x18f314, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0186.908] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0186.908] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini")) returned 1 [0186.909] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\desktop.ini" (normalized: "c:\\users\\default\\favorites\\links\\desktop.ini")) returned 0xffffffff [0186.909] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0186.910] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0186.910] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url.ozq0" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0186.917] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2 [0186.917] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0186.917] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0186.963] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xe2, lpOverlapped=0x0) returned 1 [0186.964] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xf0, lpOverlapped=0x0) returned 1 [0186.965] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.032] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.043] CloseHandle (hObject=0xec) returned 1 [0187.044] CloseHandle (hObject=0xf0) returned 1 [0187.044] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url.ozq0" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url.ozq0")) returned 0 [0187.044] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url.ozq0" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url.ozq0")) returned 0x20 [0187.044] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x26dd20, dwReserved1=0x18f314, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0x26cc80 [0187.045] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x26dd20, dwReserved1=0x18f314, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0187.045] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0187.045] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url")) returned 1 [0187.046] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url")) returned 0xffffffff [0187.046] FindNextFileA (in: hFindFile=0x26ccd8, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0187.046] FindClose (in: hFindFile=0x26ccd8 | out: hFindFile=0x26ccd8) returned 1 [0187.046] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x752e7972, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0187.046] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26ccf0 [0187.143] FindNextFileA (in: hFindFile=0x26ccf0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0187.143] FindNextFileA (in: hFindFile=0x26ccf0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0187.144] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.144] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0187.145] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0187.145] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0187.146] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0187.192] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0187.194] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0187.195] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.259] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.272] CloseHandle (hObject=0xf0) returned 1 [0187.272] CloseHandle (hObject=0xec) returned 1 [0187.273] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url.ozq0")) returned 0 [0187.273] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url.ozq0")) returned 0x20 [0187.273] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26ddd0, dwReserved1=0x18f314, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 0x26cc80 [0187.273] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26ddd0, dwReserved1=0x18f314, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 0 [0187.273] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0187.273] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url")) returned 1 [0187.274] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url")) returned 0xffffffff [0187.274] FindNextFileA (in: hFindFile=0x26ccf0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0187.275] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0187.275] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.275] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0187.275] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0187.275] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0187.323] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0187.324] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0187.325] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.395] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.413] CloseHandle (hObject=0xec) returned 1 [0187.414] CloseHandle (hObject=0xf0) returned 1 [0187.414] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.ozq0")) returned 0 [0187.415] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url.ozq0")) returned 0x20 [0187.415] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x18f314, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 0x26cc80 [0187.415] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x18f314, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 0 [0187.415] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0187.415] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 1 [0187.416] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 0xffffffff [0187.416] FindNextFileA (in: hFindFile=0x26ccf0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0187.417] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.417] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0187.417] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0187.418] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0187.418] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0187.467] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0187.468] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0187.469] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.539] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.550] CloseHandle (hObject=0xf0) returned 1 [0187.551] CloseHandle (hObject=0xec) returned 1 [0187.551] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url.ozq0")) returned 0 [0187.551] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url.ozq0")) returned 0x20 [0187.552] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26ddd8, dwReserved1=0x18f314, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 0x26cc80 [0187.552] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26ddd8, dwReserved1=0x18f314, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 0 [0187.552] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0187.552] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url")) returned 1 [0187.553] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url")) returned 0xffffffff [0187.553] FindNextFileA (in: hFindFile=0x26ccf0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0187.553] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0187.553] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.554] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0187.554] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0187.555] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0187.590] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0187.591] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0187.592] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.655] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.666] CloseHandle (hObject=0xec) returned 1 [0187.667] CloseHandle (hObject=0xf0) returned 1 [0187.667] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url.ozq0")) returned 0 [0187.667] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url.ozq0")) returned 0x20 [0187.667] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26ddd8, dwReserved1=0x18f314, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 0x26cc80 [0187.668] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26ddd8, dwReserved1=0x18f314, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 0 [0187.668] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0187.668] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url")) returned 1 [0187.669] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url")) returned 0xffffffff [0187.669] FindNextFileA (in: hFindFile=0x26ccf0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0187.669] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.669] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0187.670] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x86 [0187.670] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0187.670] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0187.741] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x86, lpOverlapped=0x0) returned 1 [0187.742] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0187.743] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.801] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.812] CloseHandle (hObject=0xf0) returned 1 [0187.813] CloseHandle (hObject=0xec) returned 1 [0187.813] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url.ozq0")) returned 0 [0187.813] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url.ozq0" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url.ozq0")) returned 0x20 [0187.814] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x26ddd0, dwReserved1=0x18f314, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0x26cc80 [0187.814] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x26ddd0, dwReserved1=0x18f314, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0187.814] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0187.814] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url")) returned 1 [0187.815] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url")) returned 0xffffffff [0187.815] FindNextFileA (in: hFindFile=0x26ccf0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0187.815] FindClose (in: hFindFile=0x26ccf0 | out: hFindFile=0x26ccf0) returned 1 [0187.815] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65726f74, dwReserved1=0x6c72752e, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0187.815] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26cce0 [0187.872] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0187.872] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0187.873] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0187.873] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.874] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0187.874] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0187.874] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0187.922] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0187.923] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0187.924] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0187.980] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0187.994] CloseHandle (hObject=0xec) returned 1 [0187.994] CloseHandle (hObject=0xf0) returned 1 [0187.994] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url.ozq0")) returned 0 [0187.995] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url.ozq0")) returned 0x20 [0187.995] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 0x26cc80 [0187.995] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 0 [0187.995] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0187.995] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url")) returned 1 [0187.996] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url")) returned 0xffffffff [0187.996] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0187.997] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0187.997] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0187.997] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0187.997] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0187.998] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0188.059] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0188.060] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0188.061] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.119] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.133] CloseHandle (hObject=0xf0) returned 1 [0188.133] CloseHandle (hObject=0xec) returned 1 [0188.133] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url.ozq0")) returned 0 [0188.134] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url.ozq0")) returned 0x20 [0188.134] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 0x26cc80 [0188.134] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 0 [0188.134] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0188.134] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url")) returned 1 [0188.135] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url")) returned 0xffffffff [0188.135] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0188.136] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0188.136] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.136] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0188.136] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0188.137] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0188.236] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0188.238] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0188.239] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.296] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.308] CloseHandle (hObject=0xec) returned 1 [0188.308] CloseHandle (hObject=0xf0) returned 1 [0188.308] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url.ozq0")) returned 0 [0188.309] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url.ozq0")) returned 0x20 [0188.309] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 0x26cc80 [0188.309] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 0 [0188.309] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0188.309] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url")) returned 1 [0188.310] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url")) returned 0xffffffff [0188.310] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0188.311] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.311] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0188.311] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0188.311] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0188.312] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0188.417] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0188.418] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0188.419] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.480] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.493] CloseHandle (hObject=0xf0) returned 1 [0188.493] CloseHandle (hObject=0xec) returned 1 [0188.494] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url.ozq0")) returned 0 [0188.494] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url.ozq0")) returned 0x20 [0188.494] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 0x26cc80 [0188.494] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 0 [0188.494] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0188.495] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url")) returned 1 [0188.496] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url")) returned 0xffffffff [0188.496] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0188.496] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0188.497] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.497] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0188.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0188.497] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0188.616] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0188.617] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0188.618] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.680] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.694] CloseHandle (hObject=0xec) returned 1 [0188.695] CloseHandle (hObject=0xf0) returned 1 [0188.695] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url.ozq0")) returned 0 [0188.695] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url.ozq0")) returned 0x20 [0188.695] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSN.url", cAlternateFileName="")) returned 0x26cc80 [0188.696] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSN.url", cAlternateFileName="")) returned 0 [0188.696] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0188.696] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url")) returned 1 [0188.697] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url")) returned 0xffffffff [0188.697] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0188.697] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.698] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0188.698] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0188.698] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0188.699] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0188.812] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0188.813] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0188.815] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0188.869] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0188.891] CloseHandle (hObject=0xf0) returned 1 [0188.891] CloseHandle (hObject=0xec) returned 1 [0188.891] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url.ozq0")) returned 0 [0188.892] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url.ozq0" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url.ozq0")) returned 0x20 [0188.892] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0x26cc80 [0188.892] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0188.892] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0188.892] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url")) returned 1 [0188.893] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url")) returned 0xffffffff [0188.893] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0188.893] FindClose (in: hFindFile=0x26cce0 | out: hFindFile=0x26cce0) returned 1 [0188.894] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0188.894] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName=".", cAlternateFileName="")) returned 0x26cce0 [0188.898] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="..", cAlternateFileName="")) returned 1 [0188.898] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0188.898] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0188.899] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0188.899] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0188.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0188.900] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0188.980] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0188.981] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0188.982] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.039] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.060] CloseHandle (hObject=0xec) returned 1 [0189.061] CloseHandle (hObject=0xf0) returned 1 [0189.061] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url.ozq0")) returned 0 [0189.062] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url.ozq0")) returned 0x20 [0189.062] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 0x26cc80 [0189.062] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 0 [0189.062] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0189.062] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url")) returned 1 [0189.064] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url")) returned 0xffffffff [0189.064] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0189.064] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.064] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0189.065] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0189.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0189.065] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0189.188] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0189.190] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0189.191] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.252] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.265] CloseHandle (hObject=0xf0) returned 1 [0189.265] CloseHandle (hObject=0xec) returned 1 [0189.266] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url.ozq0")) returned 0 [0189.266] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url.ozq0")) returned 0x20 [0189.266] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 0x26cc80 [0189.266] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 0 [0189.266] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0189.267] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url")) returned 1 [0189.267] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url")) returned 0xffffffff [0189.268] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0189.268] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0189.268] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.268] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0189.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0189.269] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0189.359] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0189.361] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0189.362] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.427] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.438] CloseHandle (hObject=0xec) returned 1 [0189.439] CloseHandle (hObject=0xf0) returned 1 [0189.439] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url.ozq0")) returned 0 [0189.439] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url.ozq0")) returned 0x20 [0189.439] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 0x26cc80 [0189.440] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 0 [0189.440] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0189.440] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url")) returned 1 [0189.441] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url")) returned 0xffffffff [0189.441] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0189.441] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0189.462] CreateFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0189.486] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x85 [0189.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0189.486] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0189.602] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x85, lpOverlapped=0x0) returned 1 [0189.604] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x90, lpOverlapped=0x0) returned 1 [0189.605] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.673] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.685] CloseHandle (hObject=0xf0) returned 1 [0189.686] CloseHandle (hObject=0xec) returned 1 [0189.686] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), lpNewFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url.ozq0")) returned 0 [0189.687] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url.ozq0" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url.ozq0")) returned 0x20 [0189.687] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0x26cc80 [0189.687] FindNextFileA (in: hFindFile=0x26cc80, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0189.687] FindClose (in: hFindFile=0x26cc80 | out: hFindFile=0x26cc80) returned 1 [0189.687] DeleteFileA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url")) returned 1 [0189.688] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url")) returned 0xffffffff [0189.688] FindNextFileA (in: hFindFile=0x26cce0, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0189.688] FindClose (in: hFindFile=0x26cce0 | out: hFindFile=0x26cce0) returned 1 [0189.689] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62abf4c0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c7275, dwReserved1=0x752e746e, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0189.690] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0189.690] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69736265, dwReserved1=0x61736574, cFileName="Links", cAlternateFileName="")) returned 1 [0189.690] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName=".", cAlternateFileName="")) returned 0x26bc78 [0189.693] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="..", cAlternateFileName="")) returned 1 [0189.694] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x70532065, dwReserved1=0x73656361, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0189.694] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0189.694] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\links\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0189.695] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x244 [0189.695] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0189.695] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0189.799] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x244, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x244, lpOverlapped=0x0) returned 1 [0189.801] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x250, lpOverlapped=0x0) returned 1 [0189.802] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0189.859] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0189.872] CloseHandle (hObject=0xe4) returned 1 [0189.872] CloseHandle (hObject=0xec) returned 1 [0189.872] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Links\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\links\\desktop.ini.ozq0")) returned 0 [0189.873] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\links\\desktop.ini.ozq0")) returned 0x20 [0189.873] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26bc38 [0189.873] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a26f40, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a26f40, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0189.873] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0189.873] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini")) returned 1 [0189.874] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\desktop.ini" (normalized: "c:\\users\\default\\links\\desktop.ini")) returned 0xffffffff [0189.875] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0189.875] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0189.875] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk.ozq0" (normalized: "c:\\users\\default\\links\\desktop.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0189.876] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d3 [0189.876] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0189.877] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0189.996] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1d3, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x1d3, lpOverlapped=0x0) returned 1 [0189.997] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x1e0, lpOverlapped=0x0) returned 1 [0189.999] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.053] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.066] CloseHandle (hObject=0xec) returned 1 [0190.066] CloseHandle (hObject=0xe4) returned 1 [0190.066] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Desktop.lnk.ozq0" (normalized: "c:\\users\\default\\links\\desktop.lnk.ozq0")) returned 0 [0190.067] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk.ozq0" (normalized: "c:\\users\\default\\links\\desktop.lnk.ozq0")) returned 0x20 [0190.067] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0x26bc38 [0190.067] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 0 [0190.067] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0190.067] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk")) returned 1 [0190.068] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Desktop.lnk" (normalized: "c:\\users\\default\\links\\desktop.lnk")) returned 0xffffffff [0190.068] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0190.069] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0190.069] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk.ozq0" (normalized: "c:\\users\\default\\links\\downloads.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0190.069] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37e [0190.069] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0190.070] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0190.171] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x37e, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x37e, lpOverlapped=0x0) returned 1 [0190.176] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x380, lpOverlapped=0x0) returned 1 [0190.178] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.234] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.245] CloseHandle (hObject=0xe4) returned 1 [0190.245] CloseHandle (hObject=0xec) returned 1 [0190.246] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\Downloads.lnk.ozq0" (normalized: "c:\\users\\default\\links\\downloads.lnk.ozq0")) returned 0 [0190.246] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk.ozq0" (normalized: "c:\\users\\default\\links\\downloads.lnk.ozq0")) returned 0x20 [0190.246] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0x26bc38 [0190.246] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 0 [0190.246] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0190.246] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk")) returned 1 [0190.247] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\Downloads.lnk" (normalized: "c:\\users\\default\\links\\downloads.lnk")) returned 0xffffffff [0190.247] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 1 [0190.248] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\OneDrive.lnk" (normalized: "c:\\users\\default\\links\\onedrive.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0190.248] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\OneDrive.lnk.ozq0" (normalized: "c:\\users\\default\\links\\onedrive.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0190.248] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x790 [0190.248] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0190.249] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0190.355] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x790, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x790, lpOverlapped=0x0) returned 1 [0190.364] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x7a0, lpOverlapped=0x0) returned 1 [0190.365] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.427] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.441] CloseHandle (hObject=0xec) returned 1 [0190.441] CloseHandle (hObject=0xe4) returned 1 [0190.441] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\OneDrive.lnk" (normalized: "c:\\users\\default\\links\\onedrive.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\OneDrive.lnk.ozq0" (normalized: "c:\\users\\default\\links\\onedrive.lnk.ozq0")) returned 0 [0190.442] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\OneDrive.lnk.ozq0" (normalized: "c:\\users\\default\\links\\onedrive.lnk.ozq0")) returned 0x20 [0190.442] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\OneDrive.lnk", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0x26bc38 [0190.442] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x790, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="OneDrive.lnk", cAlternateFileName="")) returned 0 [0190.442] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0190.443] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\OneDrive.lnk" (normalized: "c:\\users\\default\\links\\onedrive.lnk")) returned 1 [0190.444] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\OneDrive.lnk" (normalized: "c:\\users\\default\\links\\onedrive.lnk")) returned 0xffffffff [0190.444] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0190.444] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0190.444] CreateFileA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.ozq0" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0190.445] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16b [0190.445] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0190.445] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0190.532] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x16b, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x16b, lpOverlapped=0x0) returned 1 [0190.533] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x170, lpOverlapped=0x0) returned 1 [0190.534] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.593] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.608] CloseHandle (hObject=0xe4) returned 1 [0190.609] CloseHandle (hObject=0xec) returned 1 [0190.610] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk"), lpNewFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.ozq0" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.ozq0")) returned 0 [0190.610] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk.ozq0" (normalized: "c:\\users\\default\\links\\recentplaces.lnk.ozq0")) returned 0x20 [0190.610] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0x26bc38 [0190.610] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0190.610] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0190.611] DeleteFileA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk")) returned 1 [0190.612] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\default\\links\\recentplaces.lnk")) returned 0xffffffff [0190.612] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0190.612] FindClose (in: hFindFile=0x26bc78 | out: hFindFile=0x26bc78) returned 1 [0190.612] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0190.612] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Local Settings\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a4d0a0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a4d0a0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="RecentPlaces.lnk", cAlternateFileName="ð«&")) returned 0xffffffff [0190.612] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="Music", cAlternateFileName="")) returned 1 [0190.612] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Music\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26bc78 [0190.613] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0190.613] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0190.613] CreateFileA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0190.614] CreateFileA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\music\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0190.614] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0190.614] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0190.614] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0190.734] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x1f8, lpOverlapped=0x0) returned 1 [0190.735] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x200, lpOverlapped=0x0) returned 1 [0190.737] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0190.803] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0190.817] CloseHandle (hObject=0xec) returned 1 [0190.817] CloseHandle (hObject=0xe4) returned 1 [0190.817] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Music\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\music\\desktop.ini.ozq0")) returned 0 [0190.818] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\music\\desktop.ini.ozq0")) returned 0x20 [0190.818] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Music\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26bc38 [0190.818] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0190.818] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0190.818] DeleteFileA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini")) returned 1 [0190.819] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Music\\desktop.ini" (normalized: "c:\\users\\default\\music\\desktop.ini")) returned 0xffffffff [0190.819] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0190.819] FindClose (in: hFindFile=0x26bc78 | out: hFindFile=0x26bc78) returned 1 [0190.819] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0190.820] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\My Documents\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="ð«&")) returned 0xffffffff [0190.820] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NetHood", cAlternateFileName="")) returned 1 [0190.820] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NetHood\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="ð«&")) returned 0xffffffff [0190.820] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62d46c20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x6173656b, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0190.820] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0190.821] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0190.821] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc0000 [0190.821] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0190.822] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0190.945] ReadFile (in: hFile=0xd8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc0000, lpNumberOfBytesRead=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f770*=0xc0000, lpOverlapped=0x0) returned 1 [0190.982] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc0010, lpNumberOfBytesWritten=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f770*=0xc0010, lpOverlapped=0x0) returned 1 [0191.017] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.074] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.086] CloseHandle (hObject=0xd8) returned 1 [0191.087] CloseHandle (hObject=0xe4) returned 1 [0191.087] MoveFileA (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.ozq0")) returned 0 [0191.088] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.ozq0")) returned 0x20 [0191.088] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62d46c20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 0x26bc78 [0191.088] FindNextFileA (in: hFindFile=0x26bc78, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x62d46c20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 0 [0191.088] FindClose (in: hFindFile=0x26bc78 | out: hFindFile=0x26bc78) returned 1 [0191.088] DeleteFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat")) returned 1 [0191.097] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT" (normalized: "c:\\users\\default\\ntuser.dat")) returned 0xffffffff [0191.097] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x76f7387a, dwReserved1=0x766526dd, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0191.097] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG" (normalized: "c:\\users\\default\\ntuser.dat.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0191.098] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0191.098] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x400 [0191.098] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0191.099] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0191.199] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x400, lpNumberOfBytesRead=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f770*=0x400, lpOverlapped=0x0) returned 1 [0191.307] WriteFile (in: hFile=0xd8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f770*=0x410, lpOverlapped=0x0) returned 1 [0191.311] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.378] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.392] CloseHandle (hObject=0xe4) returned 1 [0191.392] CloseHandle (hObject=0xd8) returned 1 [0191.392] MoveFileA (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG" (normalized: "c:\\users\\default\\ntuser.dat.log"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log.ozq0")) returned 0 [0191.393] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log.ozq0")) returned 0x20 [0191.393] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 0x26bc38 [0191.393] FindNextFileA (in: hFindFile=0x26bc38, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 0 [0191.393] FindClose (in: hFindFile=0x26bc38 | out: hFindFile=0x26bc38) returned 1 [0191.393] DeleteFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG" (normalized: "c:\\users\\default\\ntuser.dat.log")) returned 1 [0191.395] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG" (normalized: "c:\\users\\default\\ntuser.dat.log")) returned 0xffffffff [0191.395] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0191.395] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0191.395] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log1.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0191.396] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e400 [0191.396] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0191.396] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0191.501] ReadFile (in: hFile=0xd8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2e400, lpNumberOfBytesRead=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f770*=0x2e400, lpOverlapped=0x0) returned 1 [0191.524] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2e410, lpNumberOfBytesWritten=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f770*=0x2e410, lpOverlapped=0x0) returned 1 [0191.528] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.587] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.600] CloseHandle (hObject=0xd8) returned 1 [0191.600] CloseHandle (hObject=0xe4) returned 1 [0191.600] MoveFileA (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log1.ozq0")) returned 0 [0191.601] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log1.ozq0")) returned 0x20 [0191.601] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 0x26bc88 [0191.601] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x62d46c20, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 0 [0191.601] FindClose (in: hFindFile=0x26bc88 | out: hFindFile=0x26bc88) returned 1 [0191.601] DeleteFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1")) returned 1 [0191.604] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG1" (normalized: "c:\\users\\default\\ntuser.dat.log1")) returned 0xffffffff [0191.604] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766526dd, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0191.604] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0191.605] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log2.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0191.605] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0191.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0191.605] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0191.718] MoveFileA (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log2.ozq0")) returned 0 [0191.718] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2.ozq0" (normalized: "c:\\users\\default\\ntuser.dat.log2.ozq0")) returned 0x20 [0191.718] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 0x26bc88 [0191.719] FindNextFileA (in: hFindFile=0x26bc88, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 0 [0191.719] FindClose (in: hFindFile=0x26bc88 | out: hFindFile=0x26bc88) returned 1 [0191.719] DeleteFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2")) returned 1 [0191.719] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT.LOG2" (normalized: "c:\\users\\default\\ntuser.dat.log2")) returned 0xffffffff [0191.719] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x766526dd, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0191.720] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0191.720] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0191.721] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10000 [0191.721] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0191.721] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0191.842] ReadFile (in: hFile=0xd8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10000, lpNumberOfBytesRead=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f770*=0x10000, lpOverlapped=0x0) returned 1 [0191.845] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f770*=0x10010, lpOverlapped=0x0) returned 1 [0191.848] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0191.910] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0191.925] CloseHandle (hObject=0xd8) returned 1 [0191.926] CloseHandle (hObject=0xe4) returned 1 [0191.926] MoveFileA (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.ozq0")) returned 0 [0191.926] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf.ozq0")) returned 0x20 [0191.926] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 0x26dc38 [0191.927] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 0 [0191.927] FindClose (in: hFindFile=0x26dc38 | out: hFindFile=0x26dc38) returned 1 [0191.927] DeleteFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf")) returned 1 [0191.929] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tm.blf")) returned 0xffffffff [0191.929] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x0, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0191.929] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0191.929] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0191.930] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80000 [0191.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0191.930] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0192.068] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f770*=0x80000, lpOverlapped=0x0) returned 1 [0192.082] WriteFile (in: hFile=0xd8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f770*=0x80010, lpOverlapped=0x0) returned 1 [0192.096] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.161] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.177] CloseHandle (hObject=0xe4) returned 1 [0192.177] CloseHandle (hObject=0xd8) returned 1 [0192.177] MoveFileA (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.ozq0")) returned 0 [0192.178] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms.ozq0")) returned 0x20 [0192.178] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 0x26dd20 [0192.178] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 0 [0192.178] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0192.179] DeleteFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms")) returned 1 [0192.185] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000001.regtrans-ms")) returned 0xffffffff [0192.185] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x76f7387a, dwReserved1=0x766526dd, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0192.186] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0192.186] CreateFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0192.187] GetFileSize (in: hFile=0xd8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x80000 [0192.187] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0192.188] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0192.321] ReadFile (in: hFile=0xd8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x80000, lpNumberOfBytesRead=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f770*=0x80000, lpOverlapped=0x0) returned 1 [0192.334] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x80010, lpNumberOfBytesWritten=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f770*=0x80010, lpOverlapped=0x0) returned 1 [0192.347] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.410] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.427] CloseHandle (hObject=0xd8) returned 1 [0192.427] CloseHandle (hObject=0xe4) returned 1 [0192.428] MoveFileA (lpExistingFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.ozq0")) returned 0 [0192.428] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.ozq0" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms.ozq0")) returned 0x20 [0192.429] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 0x26dd20 [0192.429] FindNextFileA (in: hFindFile=0x26dd20, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 0 [0192.429] FindClose (in: hFindFile=0x26dd20 | out: hFindFile=0x26dd20) returned 1 [0192.429] DeleteFileA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms")) returned 1 [0192.436] GetFileAttributesA (lpFileName="C:\\Users\\Default\\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\default\\ntuser.dat{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.tmcontainer00000000000000000002.regtrans-ms")) returned 0xffffffff [0192.436] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x76f7387a, dwReserved1=0x766526dd, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0192.436] CreateFileA (lpFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0192.437] CreateFileA (lpFileName="C:\\Users\\Default\\ntuser.ini.ozq0" (normalized: "c:\\users\\default\\ntuser.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0192.438] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14 [0192.438] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0192.438] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0192.567] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f770*=0x14, lpOverlapped=0x0) returned 1 [0192.568] WriteFile (in: hFile=0xd8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18f770, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f770*=0x20, lpOverlapped=0x0) returned 1 [0192.569] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.623] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.635] CloseHandle (hObject=0xe4) returned 1 [0192.635] CloseHandle (hObject=0xd8) returned 1 [0192.635] MoveFileA (lpExistingFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini"), lpNewFileName="C:\\Users\\Default\\ntuser.ini.ozq0" (normalized: "c:\\users\\default\\ntuser.ini.ozq0")) returned 0 [0192.636] GetFileAttributesA (lpFileName="C:\\Users\\Default\\ntuser.ini.ozq0" (normalized: "c:\\users\\default\\ntuser.ini.ozq0")) returned 0x20 [0192.636] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\ntuser.ini", lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ntuser.ini", cAlternateFileName="")) returned 0x26dc78 [0192.636] FindNextFileA (in: hFindFile=0x26dc78, lpFindFileData=0x18f66c | out: lpFindFileData=0x18f66c*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x629b4b20, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ntuser.ini", cAlternateFileName="")) returned 0 [0192.636] FindClose (in: hFindFile=0x26dc78 | out: hFindFile=0x26dc78) returned 1 [0192.638] DeleteFileA (lpFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini")) returned 1 [0192.639] GetFileAttributesA (lpFileName="C:\\Users\\Default\\ntuser.ini" (normalized: "c:\\users\\default\\ntuser.ini")) returned 0xffffffff [0192.639] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766526dd, cFileName="Pictures", cAlternateFileName="")) returned 1 [0192.639] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Pictures\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x380036, dwReserved1=0x26dc38, cFileName=".", cAlternateFileName="")) returned 0x26dc38 [0192.639] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x380036, dwReserved1=0x26dc38, cFileName="..", cAlternateFileName="")) returned 1 [0192.639] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x380036, dwReserved1=0x26dc38, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0192.640] CreateFileA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0192.640] CreateFileA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\pictures\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0192.640] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0192.640] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0192.641] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0192.738] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x1f8, lpOverlapped=0x0) returned 1 [0192.739] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x200, lpOverlapped=0x0) returned 1 [0192.740] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.799] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.812] CloseHandle (hObject=0xe4) returned 1 [0192.812] CloseHandle (hObject=0xec) returned 1 [0192.813] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Pictures\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\pictures\\desktop.ini.ozq0")) returned 0 [0192.813] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\pictures\\desktop.ini.ozq0")) returned 0x20 [0192.813] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dcd0 [0192.813] FindNextFileA (in: hFindFile=0x26dcd0, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0192.813] FindClose (in: hFindFile=0x26dcd0 | out: hFindFile=0x26dcd0) returned 1 [0192.814] DeleteFileA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini")) returned 1 [0192.815] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Pictures\\desktop.ini" (normalized: "c:\\users\\default\\pictures\\desktop.ini")) returned 0xffffffff [0192.815] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x380036, dwReserved1=0x26dc38, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0192.815] FindClose (in: hFindFile=0x26dc38 | out: hFindFile=0x26dc38) returned 1 [0192.815] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766526dd, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0192.815] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\PrintHood\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x380036, dwReserved1=0x26dc38, cFileName="desktop.ini", cAlternateFileName="ð«&")) returned 0xffffffff [0192.815] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766526dd, cFileName="Recent", cAlternateFileName="")) returned 1 [0192.815] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Recent\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x380036, dwReserved1=0x26dc38, cFileName="desktop.ini", cAlternateFileName="ð«&")) returned 0xffffffff [0192.816] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766526dd, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0192.816] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Saved Games\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26dc88 [0192.816] FindNextFileA (in: hFindFile=0x26dc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0192.816] FindNextFileA (in: hFindFile=0x26dc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0192.816] CreateFileA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0192.817] CreateFileA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\saved games\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0192.817] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11a [0192.817] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0192.818] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0192.917] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x11a, lpOverlapped=0x0) returned 1 [0192.918] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x120, lpOverlapped=0x0) returned 1 [0192.919] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0192.977] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0192.990] CloseHandle (hObject=0xec) returned 1 [0192.990] CloseHandle (hObject=0xe4) returned 1 [0192.990] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Saved Games\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\saved games\\desktop.ini.ozq0")) returned 0 [0192.991] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\saved games\\desktop.ini.ozq0")) returned 0x20 [0192.991] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dc38 [0192.991] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0192.991] FindClose (in: hFindFile=0x26dc38 | out: hFindFile=0x26dc38) returned 1 [0192.991] DeleteFileA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini")) returned 1 [0192.992] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Saved Games\\desktop.ini" (normalized: "c:\\users\\default\\saved games\\desktop.ini")) returned 0xffffffff [0192.992] FindNextFileA (in: hFindFile=0x26dc88, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0192.992] FindClose (in: hFindFile=0x26dc88 | out: hFindFile=0x26dc88) returned 1 [0192.993] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x766526dd, cFileName="Searches", cAlternateFileName="")) returned 1 [0192.993] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Searches\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26dc38 [0193.008] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x629b4b20, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0193.008] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.009] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0193.009] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\searches\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0193.010] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20c [0193.010] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0193.010] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0193.119] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x20c, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x20c, lpOverlapped=0x0) returned 1 [0193.120] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x210, lpOverlapped=0x0) returned 1 [0193.121] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.184] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.196] CloseHandle (hObject=0xe4) returned 1 [0193.197] CloseHandle (hObject=0xec) returned 1 [0193.197] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Searches\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\searches\\desktop.ini.ozq0")) returned 0 [0193.198] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\searches\\desktop.ini.ozq0")) returned 0x20 [0193.198] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Searches\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dcd0 [0193.198] FindNextFileA (in: hFindFile=0x26dcd0, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0193.198] FindClose (in: hFindFile=0x26dcd0 | out: hFindFile=0x26dcd0) returned 1 [0193.198] DeleteFileA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini")) returned 1 [0193.200] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\desktop.ini" (normalized: "c:\\users\\default\\searches\\desktop.ini")) returned 0xffffffff [0193.200] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0193.200] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0193.201] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms.ozq0" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0193.201] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8 [0193.201] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0193.202] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0193.320] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0xf8, lpOverlapped=0x0) returned 1 [0193.321] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x100, lpOverlapped=0x0) returned 1 [0193.322] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.380] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.392] CloseHandle (hObject=0xec) returned 1 [0193.393] CloseHandle (hObject=0xe4) returned 1 [0193.393] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms"), lpNewFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms.ozq0" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms.ozq0")) returned 0 [0193.393] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms.ozq0" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms.ozq0")) returned 0x20 [0193.393] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 0x26dce0 [0193.394] FindNextFileA (in: hFindFile=0x26dce0, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 0 [0193.394] FindClose (in: hFindFile=0x26dce0 | out: hFindFile=0x26dce0) returned 1 [0193.394] DeleteFileA (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms")) returned 0 [0193.394] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms")) returned 0x23 [0193.394] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0193.395] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0193.395] CreateFileA (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms.ozq0" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0193.395] GetFileSize (in: hFile=0xe4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf8 [0193.395] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0193.396] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0193.492] ReadFile (in: hFile=0xe4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0xf8, lpOverlapped=0x0) returned 1 [0193.494] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x100, lpOverlapped=0x0) returned 1 [0193.495] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.549] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.561] CloseHandle (hObject=0xe4) returned 1 [0193.561] CloseHandle (hObject=0xec) returned 1 [0193.561] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms"), lpNewFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms.ozq0" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms.ozq0")) returned 0 [0193.562] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms.ozq0" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms.ozq0")) returned 0x20 [0193.562] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0x26dcf0 [0193.562] FindNextFileA (in: hFindFile=0x26dcf0, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0193.562] FindClose (in: hFindFile=0x26dcf0 | out: hFindFile=0x26dcf0) returned 1 [0193.562] DeleteFileA (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms")) returned 0 [0193.562] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms")) returned 0x23 [0193.562] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0193.562] FindClose (in: hFindFile=0x26dc38 | out: hFindFile=0x26dc38) returned 1 [0193.563] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="SendTo", cAlternateFileName="")) returned 1 [0193.563] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\SendTo\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Indexed Locations.search-ms", cAlternateFileName="ð«&")) returned 0xffffffff [0193.563] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0193.563] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Start Menu\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Indexed Locations.search-ms", cAlternateFileName="ð«&")) returned 0xffffffff [0193.563] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0193.563] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Templates\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="Indexed Locations.search-ms", cAlternateFileName="ð«&")) returned 0xffffffff [0193.563] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 1 [0193.563] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Videos\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName=".", cAlternateFileName="")) returned 0x26dc78 [0193.563] FindNextFileA (in: hFindFile=0x26dc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="..", cAlternateFileName="")) returned 1 [0193.564] FindNextFileA (in: hFindFile=0x26dc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.564] CreateFileA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0193.564] CreateFileA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\videos\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe4 [0193.564] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f8 [0193.564] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0193.565] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0193.659] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1f8, lpNumberOfBytesRead=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f508*=0x1f8, lpOverlapped=0x0) returned 1 [0193.660] WriteFile (in: hFile=0xe4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18f508, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f508*=0x200, lpOverlapped=0x0) returned 1 [0193.661] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.725] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.737] CloseHandle (hObject=0xec) returned 1 [0193.737] CloseHandle (hObject=0xe4) returned 1 [0193.738] MoveFileA (lpExistingFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini"), lpNewFileName="C:\\Users\\Default\\Videos\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\videos\\desktop.ini.ozq0")) returned 0 [0193.738] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini.ozq0" (normalized: "c:\\users\\default\\videos\\desktop.ini.ozq0")) returned 0x20 [0193.738] FindFirstFileA (in: lpFileName="C:\\Users\\Default\\Videos\\desktop.ini", lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dc38 [0193.738] FindNextFileA (in: hFindFile=0x26dc38, lpFindFileData=0x18f404 | out: lpFindFileData=0x18f404*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0193.738] FindClose (in: hFindFile=0x26dc38 | out: hFindFile=0x26dc38) returned 1 [0193.738] DeleteFileA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini")) returned 1 [0193.739] GetFileAttributesA (lpFileName="C:\\Users\\Default\\Videos\\desktop.ini" (normalized: "c:\\users\\default\\videos\\desktop.ini")) returned 0xffffffff [0193.739] FindNextFileA (in: hFindFile=0x26dc78, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x62a00de0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x76f7387a, dwReserved1=0x766524b5, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0193.739] FindClose (in: hFindFile=0x26dc78 | out: hFindFile=0x26dc78) returned 1 [0193.740] FindNextFileA (in: hFindFile=0x26abf0, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="")) returned 0 [0193.740] FindClose (in: hFindFile=0x26abf0 | out: hFindFile=0x26abf0) returned 1 [0193.740] FindNextFileA (in: hFindFile=0x269b70, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x64623838, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0193.740] FindFirstFileA (in: lpFileName="C:\\Users\\Default User\\*.*", lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62a00de0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x732e736e, cFileName="Videos", cAlternateFileName="p\x9b&")) returned 0xffffffff [0193.740] FindNextFileA (in: hFindFile=0x269b70, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x64623838, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0193.740] CreateFileA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd4 [0193.740] CreateFileA (lpFileName="C:\\Users\\desktop.ini.ozq0" (normalized: "c:\\users\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xd8 [0193.741] GetFileSize (in: hFile=0xd4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0193.741] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0193.741] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0193.895] ReadFile (in: hFile=0xd4, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18f9d8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f9d8*=0xae, lpOverlapped=0x0) returned 1 [0193.896] WriteFile (in: hFile=0xd8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18f9d8, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f9d8*=0xb0, lpOverlapped=0x0) returned 1 [0193.898] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0193.962] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0193.977] CloseHandle (hObject=0xd4) returned 1 [0193.978] CloseHandle (hObject=0xd8) returned 1 [0193.978] MoveFileA (lpExistingFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini"), lpNewFileName="C:\\Users\\desktop.ini.ozq0" (normalized: "c:\\users\\desktop.ini.ozq0")) returned 0 [0193.979] GetFileAttributesA (lpFileName="C:\\Users\\desktop.ini.ozq0" (normalized: "c:\\users\\desktop.ini.ozq0")) returned 0x20 [0193.979] FindFirstFileA (in: lpFileName="C:\\Users\\desktop.ini", lpFindFileData=0x18f8d4 | out: lpFindFileData=0x18f8d4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dc70 [0193.979] FindNextFileA (in: hFindFile=0x26dc70, lpFindFileData=0x18f8d4 | out: lpFindFileData=0x18f8d4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0193.979] FindClose (in: hFindFile=0x26dc70 | out: hFindFile=0x26dc70) returned 1 [0193.979] DeleteFileA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 1 [0193.981] GetFileAttributesA (lpFileName="C:\\Users\\desktop.ini" (normalized: "c:\\users\\desktop.ini")) returned 0xffffffff [0193.981] FindNextFileA (in: hFindFile=0x269b70, lpFindFileData=0x18fc60 | out: lpFindFileData=0x18fc60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76652845, cFileName="kEecfMwgj", cAlternateFileName="KEECFM~1")) returned 1 [0193.981] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\*.*", lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0028, dwReserved1=0x26dc38, cFileName=".", cAlternateFileName="")) returned 0x26dc70 [0193.981] FindNextFileA (in: hFindFile=0x26dc70, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x791634f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xf29f86d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf29f86d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0028, dwReserved1=0x26dc38, cFileName="..", cAlternateFileName="")) returned 1 [0193.981] FindNextFileA (in: hFindFile=0x26dc70, lpFindFileData=0x18f9f8 | out: lpFindFileData=0x18f9f8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2a0028, dwReserved1=0x26dc38, cFileName="AppData", cAlternateFileName="")) returned 1 [0193.981] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\*.*", lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName=".", cAlternateFileName="")) returned 0x26bbc0 [0193.982] FindNextFileA (in: hFindFile=0x26bbc0, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 1 [0193.982] FindNextFileA (in: hFindFile=0x26bbc0, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7b85dd30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b85dd30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="Local", cAlternateFileName="")) returned 1 [0193.982] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7b85dd30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b85dd30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd08 [0193.982] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7b85dd30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b85dd30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18f2a4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0193.982] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79d965b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79d965b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79d965b0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x76f73c74, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0193.982] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x3e, ftCreationTime.dwLowDateTime=0x4c000844, ftCreationTime.dwHighDateTime=0x2500c4, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x2574c0, ftLastWriteTime.dwLowDateTime=0xc0002, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x271dc8, nFileSizeLow=0x271dc8, dwReserved0=0x271dc3, dwReserved1=0x0, cFileName="°ó\x18", cAlternateFileName="\x08Ý&")) returned 0xffffffff [0193.983] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79dbc710, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79dbc710, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79dbc710, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x76f73c74, cFileName="History", cAlternateFileName="")) returned 1 [0193.983] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\History\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x3e, ftCreationTime.dwLowDateTime=0x4c000844, ftCreationTime.dwHighDateTime=0x2500c4, ftLastAccessTime.dwLowDateTime=0x1, ftLastAccessTime.dwHighDateTime=0x2574c0, ftLastWriteTime.dwLowDateTime=0xc0002, ftLastWriteTime.dwHighDateTime=0x8, nFileSizeHigh=0x271dc8, nFileSizeLow=0x271dc8, dwReserved0=0x271dc3, dwReserved1=0x0, cFileName="°ó\x18", cAlternateFileName="\x08Ý&")) returned 0xffffffff [0193.983] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5f818830, ftLastWriteTime.dwHighDateTime=0x1d82a26, nFileSizeHigh=0x0, nFileSizeLow=0x11f663, dwReserved0=0xa0000003, dwReserved1=0x76f73c74, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0193.983] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0193.983] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\IconCache.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iconcache.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0193.984] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11f663 [0193.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0193.985] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0194.094] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11f663, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x11f663, lpOverlapped=0x0) returned 1 [0194.128] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x11f670, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x11f670, lpOverlapped=0x0) returned 1 [0194.154] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.217] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.229] CloseHandle (hObject=0xec) returned 1 [0194.229] CloseHandle (hObject=0xf0) returned 1 [0194.230] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iconcache.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\IconCache.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iconcache.db.ozq0")) returned 0 [0194.230] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\IconCache.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iconcache.db.ozq0")) returned 0x2020 [0194.230] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\IconCache.db", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5f818830, ftLastWriteTime.dwHighDateTime=0x1d82a26, nFileSizeHigh=0x0, nFileSizeLow=0x11f663, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 0x26dcb0 [0194.230] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5f818830, ftLastWriteTime.dwHighDateTime=0x1d82a26, nFileSizeHigh=0x0, nFileSizeLow=0x11f663, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 0 [0194.230] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0194.230] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iconcache.db")) returned 1 [0194.232] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\iconcache.db")) returned 0xffffffff [0194.233] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2cedac90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0194.233] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2cedac90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c005a, dwReserved1=0x26dd48, cFileName=".", cAlternateFileName="")) returned 0x26dcb0 [0194.233] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2cedac90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c005a, dwReserved1=0x26dd48, cFileName="..", cAlternateFileName="")) returned 1 [0194.233] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c005a, dwReserved1=0x26dd48, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0194.233] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0194.233] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 1 [0194.233] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 0 [0194.233] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0194.233] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79bcd530, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c005a, dwReserved1=0x26dd48, cFileName="Feeds", cAlternateFileName="")) returned 1 [0194.233] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79bcd530, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName=".", cAlternateFileName="")) returned 0x274de0 [0194.233] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79bcd530, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 1 [0194.234] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1 [0194.234] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0194.234] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0194.234] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a00 [0194.234] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0194.235] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0194.356] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1a00, lpOverlapped=0x0) returned 1 [0194.356] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x1a10, lpOverlapped=0x0) returned 1 [0194.357] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.415] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.428] CloseHandle (hObject=0xdc) returned 1 [0194.429] CloseHandle (hObject=0xe8) returned 1 [0194.429] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.ozq0")) returned 0 [0194.429] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.ozq0")) returned 0x2020 [0194.429] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 0x26dd48 [0194.430] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff107f92, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 0 [0194.430] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0194.430] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 0 [0194.430] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 0x2020 [0194.431] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1 [0194.431] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x275e28, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0194.438] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x275e28, cFileName="..", cAlternateFileName="")) returned 1 [0194.439] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x8e008c, dwReserved1=0x275e28, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1 [0194.439] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0194.439] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0194.440] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0194.440] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0194.440] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0194.519] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x7000, lpOverlapped=0x0) returned 1 [0194.558] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x7010, lpOverlapped=0x0) returned 1 [0194.560] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0194.615] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0194.629] CloseHandle (hObject=0xdc) returned 1 [0194.629] CloseHandle (hObject=0xe0) returned 1 [0194.630] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ozq0")) returned 0 [0194.630] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ozq0")) returned 0x2020 [0194.630] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 0x26dd88 [0194.630] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 0 [0194.630] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0194.631] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 1 [0194.632] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 0xffffffff [0194.632] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1 [0194.632] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0194.632] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0194.633] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0194.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0194.633] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0194.687] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x7000, lpOverlapped=0x0) returned 1 [0194.970] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x7010, lpOverlapped=0x0) returned 1 [0194.972] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.029] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.041] CloseHandle (hObject=0xe0) returned 1 [0195.041] CloseHandle (hObject=0xdc) returned 1 [0195.042] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ozq0")) returned 0 [0195.042] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ozq0")) returned 0x2020 [0195.042] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 0x26dd88 [0195.042] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ba73d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 0 [0195.042] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.043] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 1 [0195.044] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 0xffffffff [0195.044] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1 [0195.044] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0195.044] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0195.045] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7000 [0195.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0195.045] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0195.088] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x7000, lpOverlapped=0x0) returned 1 [0195.183] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x7010, lpOverlapped=0x0) returned 1 [0195.184] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.251] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.263] CloseHandle (hObject=0xdc) returned 1 [0195.264] CloseHandle (hObject=0xe0) returned 1 [0195.264] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ozq0")) returned 0 [0195.264] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ozq0")) returned 0x2020 [0195.265] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0x26dd88 [0195.265] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0195.265] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.265] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 1 [0195.266] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 0xffffffff [0195.266] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0 [0195.266] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0195.266] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1 [0195.266] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0195.267] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0195.267] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1 [0195.267] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0195.267] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xac00aa, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0195.267] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xac00aa, dwReserved1=0x276e30, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 1 [0195.267] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.267] CloseHandle (hObject=0xffffffff) returned 0 [0195.267] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.ozq0")) returned 0 [0195.268] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.ozq0")) returned 0xffffffff [0195.268] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0x277f40 [0195.268] FindNextFileA (in: hFindFile=0x277f40, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0195.268] FindClose (in: hFindFile=0x277f40 | out: hFindFile=0x277f40) returned 1 [0195.268] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 0 [0195.268] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 0x2020 [0195.268] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0xac00aa, dwReserved1=0x276e30, cFileName="Web Slice Gallery~.feed-ms", cAlternateFileName="WEBSLI~1.FEE")) returned 0 [0195.268] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.268] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0 [0195.268] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0195.269] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x798876f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x798876f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0 [0195.269] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0195.269] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1 [0195.269] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0195.269] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="..", cAlternateFileName="")) returned 1 [0195.269] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1 [0195.269] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0195.270] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName="..", cAlternateFileName="")) returned 1 [0195.270] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x656c6c61, dwReserved1=0x2e7e7972, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0195.270] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0195.271] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0195.272] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0195.272] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0195.272] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0195.311] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0195.312] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0195.313] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.374] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.386] CloseHandle (hObject=0xe0) returned 1 [0195.386] CloseHandle (hObject=0xdc) returned 1 [0195.387] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.ozq0")) returned 0 [0195.387] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.ozq0")) returned 0x2020 [0195.387] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x276df0 [0195.387] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0195.387] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0195.388] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 1 [0195.388] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0xffffffff [0195.389] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0195.389] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0195.389] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.389] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1 [0195.389] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0195.390] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.390] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0195.390] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0195.390] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0195.390] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0195.390] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0195.391] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0195.427] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0195.429] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0195.430] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.494] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.507] CloseHandle (hObject=0xdc) returned 1 [0195.507] CloseHandle (hObject=0xe0) returned 1 [0195.508] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.ozq0")) returned 0 [0195.509] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.ozq0")) returned 0x2020 [0195.509] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x276df0 [0195.509] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0195.509] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0195.509] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 1 [0195.510] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0xffffffff [0195.511] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0195.511] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0195.511] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.511] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1 [0195.511] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0195.512] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.512] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0195.512] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0195.513] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0195.513] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0195.513] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0195.514] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0195.561] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0195.562] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0195.563] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.622] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.635] CloseHandle (hObject=0xe0) returned 1 [0195.635] CloseHandle (hObject=0xdc) returned 1 [0195.635] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.ozq0")) returned 0 [0195.636] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.ozq0")) returned 0x2020 [0195.636] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x276df0 [0195.636] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0195.636] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0195.636] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 1 [0195.637] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0xffffffff [0195.637] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0195.637] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0195.638] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.638] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x6565662e, dwReserved1=0x736d2d64, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0195.638] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0195.638] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0195.639] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0195.639] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0195.639] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0195.678] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x43, lpOverlapped=0x0) returned 1 [0195.680] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x50, lpOverlapped=0x0) returned 1 [0195.681] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.741] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.753] CloseHandle (hObject=0xe8) returned 1 [0195.753] CloseHandle (hObject=0xdc) returned 1 [0195.754] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.ozq0")) returned 0 [0195.754] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.ozq0")) returned 0x2020 [0195.754] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dd88 [0195.754] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0195.754] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.755] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 1 [0195.756] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0xffffffff [0195.756] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5a4e63a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="index.dat", cAlternateFileName="")) returned 1 [0195.756] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0195.756] CloseHandle (hObject=0xffffffff) returned 0 [0195.756] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\index.dat.ozq0")) returned 0 [0195.756] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\index.dat.ozq0")) returned 0xffffffff [0195.757] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5a4e63a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0x26dd88 [0195.757] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5a4e63a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0195.757] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.757] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 0 [0195.757] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 0x2026 [0195.757] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1 [0195.758] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x820080, dwReserved1=0x275de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0195.758] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x820080, dwReserved1=0x275de8, cFileName="..", cAlternateFileName="")) returned 1 [0195.758] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x820080, dwReserved1=0x275de8, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0195.758] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0195.759] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0195.760] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0195.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0195.760] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0195.810] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0195.811] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0195.812] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0195.867] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0195.883] CloseHandle (hObject=0xe8) returned 1 [0195.884] CloseHandle (hObject=0xe0) returned 1 [0195.884] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.ozq0")) returned 0 [0195.885] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.ozq0")) returned 0x2020 [0195.885] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x276df0 [0195.885] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0195.885] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0195.885] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 1 [0195.886] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0xffffffff [0195.886] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1 [0195.887] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0 [0195.887] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0195.887] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79861590, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0 [0195.887] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0195.887] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2cedac90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2cedac90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363334, dwReserved1=0x42313134, cFileName="FORMS", cAlternateFileName="")) returned 1 [0195.887] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2cedac90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2cedac90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x274de0 [0195.888] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2cedac90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2cedac90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0195.888] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2cedac90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2d1623f0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1 [0195.888] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0195.916] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\forms\\frmcache.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0195.916] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c0dc [0195.916] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0195.917] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0195.954] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3c0dc, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x3c0dc, lpOverlapped=0x0) returned 1 [0195.993] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3c0e0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x3c0e0, lpOverlapped=0x0) returned 1 [0195.999] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.058] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.070] CloseHandle (hObject=0xdc) returned 1 [0196.070] CloseHandle (hObject=0xe0) returned 1 [0196.070] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\forms\\frmcache.dat.ozq0")) returned 0 [0196.071] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\forms\\frmcache.dat.ozq0")) returned 0x2020 [0196.071] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2cedac90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2d1623f0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0x26dd48 [0196.071] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2cedac90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2d1623f0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0 [0196.071] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0196.071] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 1 [0196.073] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 0xffffffff [0196.073] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2cedac90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2cedac90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2d1623f0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0 [0196.073] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0196.073] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x519a8410, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x519a8410, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d363354, dwReserved1=0x42313134, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0196.073] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x519a8410, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x519a8410, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0196.074] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x519a8410, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x519a8410, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0196.074] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="brndlog.bak", cAlternateFileName="")) returned 1 [0196.074] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0196.074] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0196.075] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fa9 [0196.075] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0196.076] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0196.117] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2fa9, lpOverlapped=0x0) returned 1 [0196.191] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2fb0, lpOverlapped=0x0) returned 1 [0196.192] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.249] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.261] CloseHandle (hObject=0xe0) returned 1 [0196.261] CloseHandle (hObject=0xdc) returned 1 [0196.261] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.ozq0")) returned 0 [0196.262] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.ozq0")) returned 0x2020 [0196.262] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="brndlog.bak", cAlternateFileName="")) returned 0x26dd88 [0196.262] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="brndlog.bak", cAlternateFileName="")) returned 0 [0196.262] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0196.262] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 1 [0196.263] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 0xffffffff [0196.263] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ef07f70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2fa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1 [0196.263] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0196.264] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0196.264] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fa5 [0196.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0196.265] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0196.301] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2fa5, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2fa5, lpOverlapped=0x0) returned 1 [0196.399] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2fb0, lpOverlapped=0x0) returned 1 [0196.401] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.477] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.490] CloseHandle (hObject=0xdc) returned 1 [0196.490] CloseHandle (hObject=0xe0) returned 1 [0196.493] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.ozq0")) returned 0 [0196.494] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.ozq0")) returned 0x2020 [0196.494] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ef07f70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2fa5, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="brndlog.txt", cAlternateFileName="")) returned 0x26dd88 [0196.494] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b81270, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b81270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ef07f70, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2fa5, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="brndlog.txt", cAlternateFileName="")) returned 0 [0196.494] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0196.494] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0196.495] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0xffffffff [0196.495] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x519a8410, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x519a8410, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e4a11a0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x0, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1 [0196.496] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0196.496] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0196.497] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2466 [0196.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0196.497] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0196.541] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2466, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2466, lpOverlapped=0x0) returned 1 [0196.542] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2470, lpOverlapped=0x0) returned 1 [0196.543] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.607] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.618] CloseHandle (hObject=0xe0) returned 1 [0196.618] CloseHandle (hObject=0xdc) returned 1 [0196.619] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.ozq0")) returned 0 [0196.619] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.ozq0")) returned 0x2020 [0196.619] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x519a8410, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x519a8410, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e4a11a0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 0x26dd88 [0196.619] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x519a8410, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x519a8410, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e4a11a0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 0 [0196.619] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0196.619] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 1 [0196.620] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 0xffffffff [0196.621] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4dbf6cc0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x4dbf6cc0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4dbf6cc0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1 [0196.621] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0196.621] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0196.623] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0196.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0196.623] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0196.666] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4000, lpOverlapped=0x0) returned 1 [0196.776] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4010, lpOverlapped=0x0) returned 1 [0196.777] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0196.838] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0196.851] CloseHandle (hObject=0xdc) returned 1 [0196.851] CloseHandle (hObject=0xe0) returned 1 [0196.851] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.ozq0")) returned 0 [0196.851] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.ozq0")) returned 0x2020 [0196.852] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4dbf6cc0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x4dbf6cc0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4dbf6cc0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0x26dd88 [0196.852] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4dbf6cc0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x4dbf6cc0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4dbf6cc0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0 [0196.852] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0196.852] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 1 [0196.853] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 0xffffffff [0196.853] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d225200, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x518e9d30, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x518e9d30, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0196.853] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d225200, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x518e9d30, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x518e9d30, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x26bc50, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0196.853] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d225200, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x518e9d30, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x518e9d30, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x26bc50, cFileName="..", cAlternateFileName="")) returned 1 [0196.854] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d225200, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x5a63d000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a63d000, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x26bc50, cFileName="Active", cAlternateFileName="")) returned 1 [0196.854] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d225200, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x5a63d000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a63d000, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x278fe0, cFileName=".", cAlternateFileName="")) returned 0x276ea0 [0196.854] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d225200, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x5a63d000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a63d000, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x278fe0, cFileName="..", cAlternateFileName="")) returned 1 [0196.854] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a049900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a049900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a663160, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x250000, dwReserved1=0x278fe0, cFileName="RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1 [0196.854] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\recoverystore.{977802e2-961f-11ec-840d-c89f1db658e4}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.854] CloseHandle (hObject=0xffffffff) returned 0 [0196.854] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\recoverystore.{977802e2-961f-11ec-840d-c89f1db658e4}.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\recoverystore.{977802e2-961f-11ec-840d-c89f1db658e4}.dat.ozq0")) returned 0 [0196.854] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\recoverystore.{977802e2-961f-11ec-840d-c89f1db658e4}.dat.ozq0")) returned 0xffffffff [0196.855] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a049900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a049900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a663160, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 0x276df0 [0196.855] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a049900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a049900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a663160, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 0 [0196.855] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0196.855] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\recoverystore.{977802e2-961f-11ec-840d-c89f1db658e4}.dat")) returned 0 [0196.855] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\RecoveryStore.{977802E2-961F-11EC-840D-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\recoverystore.{977802e2-961f-11ec-840d-c89f1db658e4}.dat")) returned 0x2020 [0196.855] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a63d000, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a63d000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5ab4bec0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="{977802E3-961F-11EC-840D-C89F1DB658E4}.dat", cAlternateFileName="{97780~1.DAT")) returned 1 [0196.855] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\{977802E3-961F-11EC-840D-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\{977802e3-961f-11ec-840d-c89f1db658e4}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0196.855] CloseHandle (hObject=0xffffffff) returned 0 [0196.855] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\{977802E3-961F-11EC-840D-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\{977802e3-961f-11ec-840d-c89f1db658e4}.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\{977802E3-961F-11EC-840D-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\{977802e3-961f-11ec-840d-c89f1db658e4}.dat.ozq0")) returned 0 [0196.855] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\{977802E3-961F-11EC-840D-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\{977802e3-961f-11ec-840d-c89f1db658e4}.dat.ozq0")) returned 0xffffffff [0196.855] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\{977802E3-961F-11EC-840D-C89F1DB658E4}.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a63d000, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a63d000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5ab4bec0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{977802E3-961F-11EC-840D-C89F1DB658E4}.dat", cAlternateFileName="{97780~1.DAT")) returned 0x276df0 [0196.856] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a63d000, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a63d000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5ab4bec0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{977802E3-961F-11EC-840D-C89F1DB658E4}.dat", cAlternateFileName="{97780~1.DAT")) returned 0 [0196.856] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0196.856] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\{977802E3-961F-11EC-840D-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\{977802e3-961f-11ec-840d-c89f1db658e4}.dat")) returned 0 [0196.856] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\{977802E3-961F-11EC-840D-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\{977802e3-961f-11ec-840d-c89f1db658e4}.dat")) returned 0x2020 [0196.856] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a63d000, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a63d000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5ab4bec0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="{977802E3-961F-11EC-840D-C89F1DB658E4}.dat", cAlternateFileName="{97780~1.DAT")) returned 0 [0196.856] FindClose (in: hFindFile=0x276ea0 | out: hFindFile=0x276ea0) returned 1 [0196.856] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x518e9d30, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x8e42ed80, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e42ed80, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d463136, dwReserved1=0x43453131, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1 [0196.856] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x518e9d30, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x8e42ed80, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e42ed80, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x276ea8 [0196.857] FindNextFileA (in: hFindFile=0x276ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x518e9d30, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x8e42ed80, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e42ed80, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0196.857] FindNextFileA (in: hFindFile=0x276ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51935ff0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x51935ff0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e454ee0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1 [0196.857] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{8ab24c65-1c57-11ec-b986-c89f1db658e4}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0196.858] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{8ab24c65-1c57-11ec-b986-c89f1db658e4}.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0196.858] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe00 [0196.858] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0196.859] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0196.895] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe00, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xe00, lpOverlapped=0x0) returned 1 [0196.950] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xe10, lpOverlapped=0x0) returned 1 [0196.951] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.014] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.026] CloseHandle (hObject=0xe8) returned 1 [0197.027] CloseHandle (hObject=0xf8) returned 1 [0197.027] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{8ab24c65-1c57-11ec-b986-c89f1db658e4}.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{8ab24c65-1c57-11ec-b986-c89f1db658e4}.dat.ozq0")) returned 0 [0197.027] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{8ab24c65-1c57-11ec-b986-c89f1db658e4}.dat.ozq0")) returned 0x2020 [0197.027] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51935ff0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x51935ff0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e454ee0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 0x276df0 [0197.027] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51935ff0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x51935ff0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e454ee0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 0 [0197.027] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0197.028] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{8ab24c65-1c57-11ec-b986-c89f1db658e4}.dat")) returned 1 [0197.028] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{8AB24C65-1C57-11EC-B986-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{8ab24c65-1c57-11ec-b986-c89f1db658e4}.dat")) returned 0xffffffff [0197.029] FindNextFileA (in: hFindFile=0x276ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e42ed80, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x8e42ed80, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e454ee0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat", cAlternateFileName="{CBE13~1.DAT")) returned 1 [0197.029] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{cbe13020-1c57-11ec-b986-c89f1db658e4}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0197.029] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{cbe13020-1c57-11ec-b986-c89f1db658e4}.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0197.030] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4c00 [0197.030] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0197.030] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0197.073] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4c00, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4c00, lpOverlapped=0x0) returned 1 [0197.076] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4c10, lpOverlapped=0x0) returned 1 [0197.077] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.135] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.159] CloseHandle (hObject=0xf8) returned 1 [0197.160] CloseHandle (hObject=0xe8) returned 1 [0197.160] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{cbe13020-1c57-11ec-b986-c89f1db658e4}.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{cbe13020-1c57-11ec-b986-c89f1db658e4}.dat.ozq0")) returned 0 [0197.160] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{cbe13020-1c57-11ec-b986-c89f1db658e4}.dat.ozq0")) returned 0x2020 [0197.161] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e42ed80, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x8e42ed80, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e454ee0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat", cAlternateFileName="{CBE13~1.DAT")) returned 0x276df0 [0197.161] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e42ed80, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x8e42ed80, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e454ee0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat", cAlternateFileName="{CBE13~1.DAT")) returned 0 [0197.161] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0197.161] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{cbe13020-1c57-11ec-b986-c89f1db658e4}.dat")) returned 1 [0197.162] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{cbe13020-1c57-11ec-b986-c89f1db658e4}.dat")) returned 0xffffffff [0197.162] FindNextFileA (in: hFindFile=0x276ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8e42ed80, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x8e42ed80, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e454ee0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x4c00, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="{CBE13020-1C57-11EC-B986-C89F1DB658E4}.dat", cAlternateFileName="{CBE13~1.DAT")) returned 0 [0197.162] FindClose (in: hFindFile=0x276ea8 | out: hFindFile=0x276ea8) returned 1 [0197.163] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x518e9d30, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x8e42ed80, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x8e42ed80, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d463136, dwReserved1=0x43453131, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0 [0197.163] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0197.163] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4d225200, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x518e9d30, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x518e9d30, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 0 [0197.163] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0197.163] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xcba84960, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xcba84960, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e656854, dwReserved1=0x42746164, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0197.163] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xcba84960, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xcba84960, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0197.165] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xcba84960, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xcba84960, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0197.165] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2ada6de0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x0, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1 [0197.166] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0197.167] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0197.167] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x105000 [0197.167] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0197.168] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0197.220] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x105000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x105000, lpOverlapped=0x0) returned 1 [0197.256] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x105010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x105010, lpOverlapped=0x0) returned 1 [0197.278] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.346] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.358] CloseHandle (hObject=0xe0) returned 1 [0197.358] CloseHandle (hObject=0xdc) returned 1 [0197.358] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.ozq0")) returned 0 [0197.358] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.ozq0")) returned 0x2020 [0197.359] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2ada6de0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 0x26dd88 [0197.359] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2ada6de0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 0 [0197.359] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0197.359] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 1 [0197.360] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 0xffffffff [0197.360] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x2acc25a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x2acc25a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x1106e, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1 [0197.360] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0197.361] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0197.361] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1106e [0197.361] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0197.361] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0197.400] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1106e, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x1106e, lpOverlapped=0x0) returned 1 [0197.405] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x11070, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x11070, lpOverlapped=0x0) returned 1 [0197.407] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.471] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.484] CloseHandle (hObject=0xdc) returned 1 [0197.484] CloseHandle (hObject=0xe0) returned 1 [0197.484] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.ozq0")) returned 0 [0197.485] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.ozq0")) returned 0x2020 [0197.485] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x2acc25a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x2acc25a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x1106e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 0x26dd88 [0197.485] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x2acc25a0, ftLastAccessTime.dwHighDateTime=0x1d706aa, ftLastWriteTime.dwLowDateTime=0x2acc25a0, ftLastWriteTime.dwHighDateTime=0x1d706aa, nFileSizeHigh=0x0, nFileSizeLow=0x1106e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 0 [0197.485] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0197.485] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 1 [0197.487] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 0xffffffff [0197.487] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7983b430, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1 [0197.487] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7983b430, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0197.488] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7983b430, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="..", cAlternateFileName="")) returned 1 [0197.488] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="en-US", cAlternateFileName="")) returned 1 [0197.488] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x278fe0, cFileName=".", cAlternateFileName="")) returned 0x276ea0 [0197.488] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x278fe0, cFileName="..", cAlternateFileName="")) returned 1 [0197.488] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x278fe0, cFileName="00008B4D", cAlternateFileName="")) returned 1 [0197.488] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x276df0 [0197.490] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0197.490] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0197.491] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0197.491] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\01_music_auto_rated_at_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.492] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x414 [0197.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0197.492] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0197.545] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x414, lpOverlapped=0x0) returned 1 [0197.554] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x420, lpOverlapped=0x0) returned 1 [0197.555] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.615] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.629] CloseHandle (hObject=0xf8) returned 1 [0197.629] CloseHandle (hObject=0xf4) returned 1 [0197.629] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\01_music_auto_rated_at_5_stars.wpl.ozq0")) returned 0 [0197.630] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\01_music_auto_rated_at_5_stars.wpl.ozq0")) returned 0x2020 [0197.630] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\01_Music_auto_rated_at_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0x276e30 [0197.630] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0 [0197.630] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0197.631] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0197.632] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\01_music_auto_rated_at_5_stars.wpl")) returned 0xffffffff [0197.632] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0197.632] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.633] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\02_music_added_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0197.633] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ff [0197.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0197.634] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0197.674] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4ff, lpOverlapped=0x0) returned 1 [0197.677] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x500, lpOverlapped=0x0) returned 1 [0197.678] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.741] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.753] CloseHandle (hObject=0xf4) returned 1 [0197.753] CloseHandle (hObject=0xf8) returned 1 [0197.753] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\02_music_added_in_the_last_month.wpl.ozq0")) returned 0 [0197.754] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\02_music_added_in_the_last_month.wpl.ozq0")) returned 0x2020 [0197.754] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\02_Music_added_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0x276e30 [0197.754] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0 [0197.755] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0197.755] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\02_music_added_in_the_last_month.wpl")) returned 1 [0197.756] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\02_music_added_in_the_last_month.wpl")) returned 0xffffffff [0197.756] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0197.756] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0197.756] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\03_music_rated_at_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.757] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f3 [0197.757] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0197.757] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0197.806] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4f3, lpOverlapped=0x0) returned 1 [0197.812] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x500, lpOverlapped=0x0) returned 1 [0197.813] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0197.871] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0197.884] CloseHandle (hObject=0xf8) returned 1 [0197.884] CloseHandle (hObject=0xf4) returned 1 [0197.884] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\03_music_rated_at_4_or_5_stars.wpl.ozq0")) returned 0 [0197.885] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\03_music_rated_at_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0197.885] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\03_Music_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0x276e30 [0197.885] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0 [0197.885] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0197.885] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0197.886] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\03_music_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0197.886] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0197.886] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0197.887] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\04_music_played_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0197.887] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x504 [0197.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0197.887] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0197.923] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x504, lpOverlapped=0x0) returned 1 [0197.958] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x510, lpOverlapped=0x0) returned 1 [0197.959] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.016] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.029] CloseHandle (hObject=0xf4) returned 1 [0198.029] CloseHandle (hObject=0xf8) returned 1 [0198.029] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\04_music_played_in_the_last_month.wpl.ozq0")) returned 0 [0198.029] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\04_music_played_in_the_last_month.wpl.ozq0")) returned 0x2020 [0198.030] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\04_Music_played_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0x276e30 [0198.030] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0 [0198.030] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0198.030] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\04_music_played_in_the_last_month.wpl")) returned 1 [0198.031] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\04_music_played_in_the_last_month.wpl")) returned 0xffffffff [0198.031] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0198.031] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0198.032] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\05_pictures_taken_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.032] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31d [0198.032] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0198.033] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0198.070] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x31d, lpOverlapped=0x0) returned 1 [0198.072] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x320, lpOverlapped=0x0) returned 1 [0198.073] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.136] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.148] CloseHandle (hObject=0xf8) returned 1 [0198.148] CloseHandle (hObject=0xf4) returned 1 [0198.148] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\05_pictures_taken_in_the_last_month.wpl.ozq0")) returned 0 [0198.149] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\05_pictures_taken_in_the_last_month.wpl.ozq0")) returned 0x2020 [0198.149] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\05_Pictures_taken_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0x276e30 [0198.149] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0 [0198.149] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0198.150] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0198.151] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\05_pictures_taken_in_the_last_month.wpl")) returned 0xffffffff [0198.151] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0198.151] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.151] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\06_pictures_rated_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0198.152] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x311 [0198.152] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0198.152] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0198.287] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x311, lpOverlapped=0x0) returned 1 [0198.289] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x320, lpOverlapped=0x0) returned 1 [0198.290] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.351] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.364] CloseHandle (hObject=0xf4) returned 1 [0198.364] CloseHandle (hObject=0xf8) returned 1 [0198.364] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\06_pictures_rated_4_or_5_stars.wpl.ozq0")) returned 0 [0198.364] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\06_pictures_rated_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0198.364] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\06_Pictures_rated_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0x276e30 [0198.365] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0 [0198.365] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0198.365] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0198.366] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\06_pictures_rated_4_or_5_stars.wpl")) returned 0xffffffff [0198.366] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0198.366] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0198.367] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\07_tv_recorded_in_the_last_week.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.367] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x410 [0198.367] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0198.368] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0198.405] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x410, lpOverlapped=0x0) returned 1 [0198.409] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x420, lpOverlapped=0x0) returned 1 [0198.410] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.471] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.484] CloseHandle (hObject=0xf8) returned 1 [0198.485] CloseHandle (hObject=0xf4) returned 1 [0198.485] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\07_tv_recorded_in_the_last_week.wpl.ozq0")) returned 0 [0198.485] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\07_tv_recorded_in_the_last_week.wpl.ozq0")) returned 0x2020 [0198.485] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\07_TV_recorded_in_the_last_week.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0x276e30 [0198.486] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0 [0198.486] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0198.486] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0198.487] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\07_tv_recorded_in_the_last_week.wpl")) returned 0xffffffff [0198.487] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0198.487] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.488] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\08_video_rated_at_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0198.488] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fc [0198.488] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0198.489] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0198.526] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x3fc, lpOverlapped=0x0) returned 1 [0198.552] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x400, lpOverlapped=0x0) returned 1 [0198.553] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.631] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.644] CloseHandle (hObject=0xf4) returned 1 [0198.644] CloseHandle (hObject=0xf8) returned 1 [0198.644] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\08_video_rated_at_4_or_5_stars.wpl.ozq0")) returned 0 [0198.645] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\08_video_rated_at_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0198.645] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\08_Video_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0x276e30 [0198.645] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0 [0198.645] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0198.645] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0198.647] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\08_video_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0198.647] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0198.647] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0198.647] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\09_music_played_the_most.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.648] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0198.648] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0198.648] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0198.699] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x401, lpOverlapped=0x0) returned 1 [0198.725] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x410, lpOverlapped=0x0) returned 1 [0198.727] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.786] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.801] CloseHandle (hObject=0xf8) returned 1 [0198.801] CloseHandle (hObject=0xf4) returned 1 [0198.802] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\09_music_played_the_most.wpl.ozq0")) returned 0 [0198.802] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\09_music_played_the_most.wpl.ozq0")) returned 0x2020 [0198.802] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\09_Music_played_the_most.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0x276e30 [0198.802] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0 [0198.803] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0198.803] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\09_music_played_the_most.wpl")) returned 1 [0198.804] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\09_music_played_the_most.wpl")) returned 0xffffffff [0198.804] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0198.804] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\10_All_Music.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.805] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\10_all_music.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0198.805] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x427 [0198.806] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0198.806] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0198.853] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x427, lpOverlapped=0x0) returned 1 [0198.855] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x430, lpOverlapped=0x0) returned 1 [0198.857] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0198.919] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0198.933] CloseHandle (hObject=0xf4) returned 1 [0198.934] CloseHandle (hObject=0xf8) returned 1 [0198.934] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\10_All_Music.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\10_all_music.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\10_all_music.wpl.ozq0")) returned 0 [0198.935] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\10_all_music.wpl.ozq0")) returned 0x2020 [0198.935] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\10_All_Music.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0x276e30 [0198.935] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0 [0198.935] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0198.935] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\10_All_Music.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\10_all_music.wpl")) returned 1 [0198.936] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\10_All_Music.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\10_all_music.wpl")) returned 0xffffffff [0198.936] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0198.936] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\11_All_Pictures.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0198.937] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\11_all_pictures.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0198.937] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x249 [0198.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0198.938] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0198.978] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x249, lpOverlapped=0x0) returned 1 [0198.980] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x250, lpOverlapped=0x0) returned 1 [0198.981] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.043] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.057] CloseHandle (hObject=0xf8) returned 1 [0199.057] CloseHandle (hObject=0xf4) returned 1 [0199.057] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\11_All_Pictures.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\11_all_pictures.wpl.ozq0")) returned 0 [0199.058] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\11_all_pictures.wpl.ozq0")) returned 0x2020 [0199.058] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\11_All_Pictures.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0x276e30 [0199.058] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0 [0199.058] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0199.058] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\11_All_Pictures.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\11_all_pictures.wpl")) returned 1 [0199.059] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\11_All_Pictures.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\11_all_pictures.wpl")) returned 0xffffffff [0199.059] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0199.060] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\12_All_Video.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.060] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\12_all_video.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0199.061] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x437 [0199.061] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0199.061] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0199.101] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x437, lpOverlapped=0x0) returned 1 [0199.103] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x440, lpOverlapped=0x0) returned 1 [0199.104] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.164] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.177] CloseHandle (hObject=0xf4) returned 1 [0199.177] CloseHandle (hObject=0xf8) returned 1 [0199.177] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\12_All_Video.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\12_all_video.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\12_all_video.wpl.ozq0")) returned 0 [0199.178] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\12_all_video.wpl.ozq0")) returned 0x2020 [0199.178] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\12_All_Video.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0x276e30 [0199.178] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0199.178] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0199.178] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\12_All_Video.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\12_all_video.wpl")) returned 1 [0199.179] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00008B4D\\12_All_Video.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00008b4d\\12_all_video.wpl")) returned 0xffffffff [0199.180] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e4412d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0199.180] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0199.180] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70772e6f, dwReserved1=0x6c70776c, cFileName="00010C6E", cAlternateFileName="")) returned 1 [0199.180] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName=".", cAlternateFileName="")) returned 0x276df0 [0199.197] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="..", cAlternateFileName="")) returned 1 [0199.197] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1 [0199.197] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0199.198] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.198] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x414 [0199.198] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0199.199] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0199.240] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x414, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x414, lpOverlapped=0x0) returned 1 [0199.245] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x420, lpOverlapped=0x0) returned 1 [0199.246] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.306] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.319] CloseHandle (hObject=0xf8) returned 1 [0199.319] CloseHandle (hObject=0xf4) returned 1 [0199.319] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.ozq0")) returned 0 [0199.320] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.ozq0")) returned 0x2020 [0199.320] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0x276e30 [0199.320] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 0 [0199.320] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0199.320] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0199.321] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 0xffffffff [0199.321] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1 [0199.322] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.323] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0199.323] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ff [0199.323] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0199.324] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0199.363] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ff, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4ff, lpOverlapped=0x0) returned 1 [0199.365] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x500, lpOverlapped=0x0) returned 1 [0199.366] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.425] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.439] CloseHandle (hObject=0xf4) returned 1 [0199.439] CloseHandle (hObject=0xf8) returned 1 [0199.439] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.ozq0")) returned 0 [0199.440] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.ozq0")) returned 0x2020 [0199.440] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0x276e30 [0199.440] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 0 [0199.440] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0199.440] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 1 [0199.441] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 0xffffffff [0199.441] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1 [0199.442] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0199.442] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.442] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f3 [0199.442] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0199.443] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0199.495] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4f3, lpOverlapped=0x0) returned 1 [0199.497] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x500, lpOverlapped=0x0) returned 1 [0199.498] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.556] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.570] CloseHandle (hObject=0xf8) returned 1 [0199.570] CloseHandle (hObject=0xf4) returned 1 [0199.571] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.ozq0")) returned 0 [0199.571] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0199.571] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0x276e30 [0199.571] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 0 [0199.571] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0199.571] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0199.572] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0199.572] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1 [0199.573] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.573] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0199.574] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x504 [0199.574] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0199.574] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0199.630] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x504, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x504, lpOverlapped=0x0) returned 1 [0199.636] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x510, lpOverlapped=0x0) returned 1 [0199.637] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.705] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.721] CloseHandle (hObject=0xf4) returned 1 [0199.721] CloseHandle (hObject=0xf8) returned 1 [0199.721] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.ozq0")) returned 0 [0199.722] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.ozq0")) returned 0x2020 [0199.722] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0x276e30 [0199.722] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 0 [0199.722] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0199.722] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 1 [0199.724] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 0xffffffff [0199.724] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1 [0199.725] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0199.725] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.726] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x31d [0199.726] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0199.726] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0199.886] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x31d, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x31d, lpOverlapped=0x0) returned 1 [0199.902] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x320, lpOverlapped=0x0) returned 1 [0199.905] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0199.973] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0199.990] CloseHandle (hObject=0xf8) returned 1 [0199.990] CloseHandle (hObject=0xf4) returned 1 [0199.991] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.ozq0")) returned 0 [0199.993] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.ozq0")) returned 0x2020 [0199.993] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0x276e30 [0199.994] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 0 [0199.994] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0199.994] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0199.996] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 0xffffffff [0199.996] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1 [0199.996] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0199.998] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0199.998] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x311 [0199.998] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0199.999] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0200.091] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x311, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x311, lpOverlapped=0x0) returned 1 [0200.158] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x320, lpOverlapped=0x0) returned 1 [0200.159] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.229] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.243] CloseHandle (hObject=0xf4) returned 1 [0200.243] CloseHandle (hObject=0xf8) returned 1 [0200.244] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.ozq0")) returned 0 [0200.244] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0200.244] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0x276e30 [0200.245] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 0 [0200.245] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0200.245] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0200.246] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 0xffffffff [0200.246] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1 [0200.246] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0200.247] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0200.247] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x410 [0200.248] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0200.248] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0200.306] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x410, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x410, lpOverlapped=0x0) returned 1 [0200.418] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x420, lpOverlapped=0x0) returned 1 [0200.420] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.479] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.495] CloseHandle (hObject=0xf8) returned 1 [0200.496] CloseHandle (hObject=0xf4) returned 1 [0200.496] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.ozq0")) returned 0 [0200.497] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.ozq0")) returned 0x2020 [0200.497] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0x276e30 [0200.497] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 0 [0200.497] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0200.497] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0200.499] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 0xffffffff [0200.499] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1 [0200.499] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0200.500] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0200.501] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3fc [0200.501] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0200.501] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0200.545] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3fc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x3fc, lpOverlapped=0x0) returned 1 [0200.590] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x400, lpOverlapped=0x0) returned 1 [0200.592] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.648] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.663] CloseHandle (hObject=0xf4) returned 1 [0200.663] CloseHandle (hObject=0xf8) returned 1 [0200.663] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.ozq0")) returned 0 [0200.664] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.ozq0")) returned 0x2020 [0200.664] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0x276e30 [0200.664] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 0 [0200.664] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0200.664] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0200.666] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 0xffffffff [0200.666] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1 [0200.666] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0200.667] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0200.667] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x401 [0200.667] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0200.668] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0200.719] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x401, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x401, lpOverlapped=0x0) returned 1 [0200.788] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x410, lpOverlapped=0x0) returned 1 [0200.789] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0200.888] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0200.902] CloseHandle (hObject=0xf8) returned 1 [0200.902] CloseHandle (hObject=0xf4) returned 1 [0200.903] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.ozq0")) returned 0 [0200.903] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.ozq0")) returned 0x2020 [0200.903] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0x276e30 [0200.904] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 0 [0200.904] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0200.904] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 1 [0200.905] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 0xffffffff [0200.905] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1 [0200.906] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0200.906] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0200.906] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x427 [0200.906] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0200.907] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0200.952] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x427, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x427, lpOverlapped=0x0) returned 1 [0201.020] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x430, lpOverlapped=0x0) returned 1 [0201.021] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.082] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.093] CloseHandle (hObject=0xf4) returned 1 [0201.093] CloseHandle (hObject=0xf8) returned 1 [0201.093] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.ozq0")) returned 0 [0201.094] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.ozq0")) returned 0x2020 [0201.094] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0x276e30 [0201.094] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 0 [0201.094] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0201.094] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 1 [0201.095] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 0xffffffff [0201.095] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1 [0201.096] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0201.096] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0201.096] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x249 [0201.096] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0201.097] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0201.130] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x249, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x249, lpOverlapped=0x0) returned 1 [0201.408] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x250, lpOverlapped=0x0) returned 1 [0201.410] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.469] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.484] CloseHandle (hObject=0xf8) returned 1 [0201.484] CloseHandle (hObject=0xf4) returned 1 [0201.484] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.ozq0")) returned 0 [0201.485] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.ozq0")) returned 0x2020 [0201.485] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0x276e30 [0201.485] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 0 [0201.485] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0201.485] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 1 [0201.486] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 0xffffffff [0201.487] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1 [0201.487] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0201.487] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0201.488] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x437 [0201.488] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0201.488] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0201.535] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x437, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x437, lpOverlapped=0x0) returned 1 [0201.673] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x440, lpOverlapped=0x0) returned 1 [0201.675] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0201.733] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0201.744] CloseHandle (hObject=0xf4) returned 1 [0201.744] CloseHandle (hObject=0xf8) returned 1 [0201.745] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.ozq0")) returned 0 [0201.745] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.ozq0")) returned 0x2020 [0201.745] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0x276e30 [0201.745] FindNextFileA (in: hFindFile=0x276e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0201.745] FindClose (in: hFindFile=0x276e30 | out: hFindFile=0x276e30) returned 1 [0201.746] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 1 [0201.747] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 0xffffffff [0201.747] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0 [0201.747] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0201.747] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70772e6f, dwReserved1=0x6c70776c, cFileName="00010C6E", cAlternateFileName="")) returned 0 [0201.747] FindClose (in: hFindFile=0x276ea0 | out: hFindFile=0x276ea0) returned 1 [0201.747] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7983b430, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e4412d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e4412d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="en-US", cAlternateFileName="")) returned 0 [0201.747] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0201.747] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcba84960, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xcba84960, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xcba84960, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1 [0201.747] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcba84960, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xcba84960, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xcba84960, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0201.749] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcba84960, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xcba84960, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xcba84960, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="..", cAlternateFileName="")) returned 1 [0201.754] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcba84960, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xcba84960, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xcba84960, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="..", cAlternateFileName="")) returned 0 [0201.754] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0201.754] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcba84960, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0xcba84960, ftLastAccessTime.dwHighDateTime=0x1d706b2, ftLastWriteTime.dwLowDateTime=0xcba84960, ftLastWriteTime.dwHighDateTime=0x1d706b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0 [0201.754] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0201.754] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ff8dd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x5bb5ba10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x5bb5ba10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="Office", cAlternateFileName="")) returned 1 [0201.754] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ff8dd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x5bb5ba10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x5bb5ba10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x274de0 [0201.755] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ff8dd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x5bb5ba10, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x5bb5ba10, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0201.755] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ff8dd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2dbcc430, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2dbcc430, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="16.0", cAlternateFileName="")) returned 1 [0201.755] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ff8dd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2dbcc430, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2dbcc430, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0201.756] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x14ff8dd0, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x2dbcc430, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2dbcc430, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="..", cAlternateFileName="")) returned 1 [0201.756] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14f5a70, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x14f5a70, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x14f5a70, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x139c4, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="excel.exe_Rules.xml", cAlternateFileName="EXCELE~1.XML")) returned 1 [0201.757] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0201.757] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0201.758] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x139c4 [0201.758] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0201.758] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0201.795] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x139c4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x139c4, lpOverlapped=0x0) returned 1 [0201.956] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x139d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x139d0, lpOverlapped=0x0) returned 1 [0201.959] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.016] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.029] CloseHandle (hObject=0xdc) returned 1 [0202.029] CloseHandle (hObject=0xe8) returned 1 [0202.029] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml.ozq0")) returned 0 [0202.030] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml.ozq0")) returned 0x2020 [0202.030] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14f5a70, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x14f5a70, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x14f5a70, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x139c4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="excel.exe_Rules.xml", cAlternateFileName="EXCELE~1.XML")) returned 0x26dd88 [0202.030] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14f5a70, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x14f5a70, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x14f5a70, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x139c4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="excel.exe_Rules.xml", cAlternateFileName="EXCELE~1.XML")) returned 0 [0202.030] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0202.030] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml")) returned 1 [0202.031] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\excel.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\excel.exe_rules.xml")) returned 0xffffffff [0202.032] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35a6de30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x35a6de30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x35a6de30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4050, dwReserved0=0x0, dwReserved1=0x0, cFileName="officec2rclient.exe_Rules.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0202.032] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0202.032] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.033] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4050 [0202.033] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0202.033] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0202.068] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4050, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4050, lpOverlapped=0x0) returned 1 [0202.082] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4060, lpOverlapped=0x0) returned 1 [0202.083] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.146] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.158] CloseHandle (hObject=0xe8) returned 1 [0202.158] CloseHandle (hObject=0xdc) returned 1 [0202.158] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml.ozq0")) returned 0 [0202.159] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml.ozq0")) returned 0x2020 [0202.159] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35a6de30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x35a6de30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x35a6de30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4050, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="officec2rclient.exe_Rules.xml", cAlternateFileName="OFFICE~1.XML")) returned 0x26dd88 [0202.159] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x35a6de30, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x35a6de30, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x35a6de30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4050, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="officec2rclient.exe_Rules.xml", cAlternateFileName="OFFICE~1.XML")) returned 0 [0202.159] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0202.159] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml")) returned 1 [0202.160] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\officec2rclient.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\officec2rclient.exe_rules.xml")) returned 0xffffffff [0202.160] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2dbcc430, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2dbcc430, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2dbcc430, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x14a97, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="outlook.exe_Rules.xml", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0202.161] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.161] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0202.161] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14a97 [0202.161] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0202.162] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0202.197] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x14a97, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x14a97, lpOverlapped=0x0) returned 1 [0202.244] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x14aa0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x14aa0, lpOverlapped=0x0) returned 1 [0202.247] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.304] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.316] CloseHandle (hObject=0xdc) returned 1 [0202.316] CloseHandle (hObject=0xe8) returned 1 [0202.317] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml.ozq0")) returned 0 [0202.317] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml.ozq0")) returned 0x2020 [0202.317] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2dbcc430, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2dbcc430, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2dbcc430, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x14a97, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="outlook.exe_Rules.xml", cAlternateFileName="OUTLOO~1.XML")) returned 0x26dd88 [0202.318] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2dbcc430, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2dbcc430, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2dbcc430, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x14a97, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="outlook.exe_Rules.xml", cAlternateFileName="OUTLOO~1.XML")) returned 0 [0202.318] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0202.318] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml")) returned 1 [0202.319] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\outlook.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\outlook.exe_rules.xml")) returned 0xffffffff [0202.319] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x250fe150, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x250fe150, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x250fe150, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x12c44, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="powerpnt.exe_Rules.xml", cAlternateFileName="POWERP~1.XML")) returned 1 [0202.320] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0202.382] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.383] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c44 [0202.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0202.383] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0202.421] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12c44, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x12c44, lpOverlapped=0x0) returned 1 [0202.474] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12c50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x12c50, lpOverlapped=0x0) returned 1 [0202.476] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.537] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.552] CloseHandle (hObject=0xe8) returned 1 [0202.552] CloseHandle (hObject=0xdc) returned 1 [0202.552] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml.ozq0")) returned 0 [0202.552] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml.ozq0")) returned 0x2020 [0202.553] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x250fe150, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x250fe150, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x250fe150, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x12c44, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="powerpnt.exe_Rules.xml", cAlternateFileName="POWERP~1.XML")) returned 0x26dd88 [0202.553] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x250fe150, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x250fe150, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x250fe150, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x12c44, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="powerpnt.exe_Rules.xml", cAlternateFileName="POWERP~1.XML")) returned 0 [0202.553] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0202.553] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml")) returned 1 [0202.554] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\powerpnt.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\powerpnt.exe_rules.xml")) returned 0xffffffff [0202.554] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x34384a70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x34384a70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WebServiceCache", cAlternateFileName="WEBSER~1")) returned 1 [0202.554] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x34384a70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x34384a70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0202.556] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x34384a70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x34384a70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0202.556] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x34384a70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x34384a70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x276e30, cFileName="AllUsers", cAlternateFileName="")) returned 1 [0202.556] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x34384a70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x34384a70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25006c, dwReserved1=0x279fe0, cFileName=".", cAlternateFileName="")) returned 0x277ee8 [0202.556] FindNextFileA (in: hFindFile=0x277ee8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x34384a70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x34384a70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25006c, dwReserved1=0x279fe0, cFileName="..", cAlternateFileName="")) returned 1 [0202.557] FindNextFileA (in: hFindFile=0x277ee8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x934dd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x934dd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25006c, dwReserved1=0x279fe0, cFileName="officeclient.microsoft.com", cAlternateFileName="OFFICE~1.COM")) returned 1 [0202.557] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\WebServiceCache\\AllUsers\\officeclient.microsoft.com\\*.*", lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x934dd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x934dd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x277e38 [0202.563] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x934dd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x934dd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0202.563] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x34384a70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x34384a70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x2071b, dwReserved0=0x18e434, dwReserved1=0x76f73c74, cFileName="B522D55B-BA64-4E5C-A9C3-1E68CB9DB929", cAlternateFileName="B522D5~1")) returned 1 [0202.563] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x934dd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x934dd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x934dd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x2071b, dwReserved0=0x650034, dwReserved1=0x630035, cFileName="C77A4C83-0FA1-4325-B7F3-C45A1261EA75", cAlternateFileName="C77A4C~1")) returned 1 [0202.563] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e6b8 | out: lpFindFileData=0x18e6b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x934dd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x934dd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x934dd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x2071b, dwReserved0=0x650034, dwReserved1=0x630035, cFileName="C77A4C83-0FA1-4325-B7F3-C45A1261EA75", cAlternateFileName="C77A4C~1")) returned 0 [0202.563] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0202.564] FindNextFileA (in: hFindFile=0x277ee8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x934dd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x934dd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x25006c, dwReserved1=0x279fe0, cFileName="officeclient.microsoft.com", cAlternateFileName="OFFICE~1.COM")) returned 0 [0202.564] FindClose (in: hFindFile=0x277ee8 | out: hFindFile=0x277ee8) returned 1 [0202.564] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34384a70, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x34384a70, ftLastAccessTime.dwHighDateTime=0x1d70910, ftLastWriteTime.dwLowDateTime=0x34384a70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x276e30, cFileName="AllUsers", cAlternateFileName="")) returned 0 [0202.564] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0202.564] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2994bd90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2994bd90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0xd939d880, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x199f1, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="winword.exe_Rules.xml", cAlternateFileName="WINWOR~1.XML")) returned 1 [0202.565] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.568] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0202.569] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x199f1 [0202.569] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0202.569] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0202.611] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x199f1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x199f1, lpOverlapped=0x0) returned 1 [0202.626] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x19a00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x19a00, lpOverlapped=0x0) returned 1 [0202.629] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.689] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.700] CloseHandle (hObject=0xdc) returned 1 [0202.700] CloseHandle (hObject=0xe8) returned 1 [0202.700] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml.ozq0")) returned 0 [0202.701] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml.ozq0")) returned 0x2020 [0202.701] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2994bd90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2994bd90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0xd939d880, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x199f1, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="winword.exe_Rules.xml", cAlternateFileName="WINWOR~1.XML")) returned 0x26dd88 [0202.701] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2994bd90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2994bd90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0xd939d880, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x199f1, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="winword.exe_Rules.xml", cAlternateFileName="WINWOR~1.XML")) returned 0 [0202.701] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0202.701] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml")) returned 1 [0202.703] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\16.0\\winword.exe_Rules.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\16.0\\winword.exe_rules.xml")) returned 0xffffffff [0202.703] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2994bd90, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2994bd90, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0xd939d880, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x199f1, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="winword.exe_Rules.xml", cAlternateFileName="WINWOR~1.XML")) returned 0 [0202.703] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0202.703] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5bb5ba10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c75525f, dwReserved1=0x782e7365, cFileName="OTele", cAlternateFileName="")) returned 1 [0202.703] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5bb5ba10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0202.708] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5bb5ba10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0202.708] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x11b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat", cAlternateFileName="{61793~2.DAT")) returned 1 [0202.708] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0202.708] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otele.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.709] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11b [0202.709] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0202.709] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0202.749] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x11b, lpOverlapped=0x0) returned 1 [0202.750] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0202.752] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.808] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.825] CloseHandle (hObject=0xe8) returned 1 [0202.825] CloseHandle (hObject=0xdc) returned 1 [0202.825] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otele.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otele.dat.ozq0")) returned 0 [0202.826] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otele.dat.ozq0")) returned 0x2020 [0202.826] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x11b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat", cAlternateFileName="{61793~2.DAT")) returned 0x26dd88 [0202.826] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x11b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat", cAlternateFileName="{61793~2.DAT")) returned 0 [0202.826] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0202.826] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otele.dat")) returned 1 [0202.827] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otele.dat")) returned 0xffffffff [0202.828] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat", cAlternateFileName="{61793~1.DAT")) returned 1 [0202.828] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otelemediumcost.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.829] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otelemediumcost.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0202.833] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x34d [0202.834] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0202.834] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0202.909] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x34d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x34d, lpOverlapped=0x0) returned 1 [0202.911] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x350, lpOverlapped=0x0) returned 1 [0202.912] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0202.968] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0202.980] CloseHandle (hObject=0xdc) returned 1 [0202.980] CloseHandle (hObject=0xe8) returned 1 [0202.981] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otelemediumcost.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otelemediumcost.dat.ozq0")) returned 0 [0202.981] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otelemediumcost.dat.ozq0")) returned 0x2020 [0202.982] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat", cAlternateFileName="{61793~1.DAT")) returned 0x26dd88 [0202.982] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x34d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat", cAlternateFileName="{61793~1.DAT")) returned 0 [0202.982] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0202.982] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otelemediumcost.dat")) returned 1 [0202.983] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (0) - 1060 - winword.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (0) - 1060 - winword.exe - otelemediumcost.dat")) returned 0xffffffff [0202.983] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat", cAlternateFileName="{61793~4.DAT")) returned 1 [0202.983] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0202.984] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otele.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0202.985] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12c [0202.985] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0202.985] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0203.046] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x12c, lpOverlapped=0x0) returned 1 [0203.047] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x130, lpOverlapped=0x0) returned 1 [0203.050] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.111] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.127] CloseHandle (hObject=0xe8) returned 1 [0203.127] CloseHandle (hObject=0xdc) returned 1 [0203.127] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otele.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otele.dat.ozq0")) returned 0 [0203.128] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otele.dat.ozq0")) returned 0x2020 [0203.128] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat", cAlternateFileName="{61793~4.DAT")) returned 0x26dd88 [0203.128] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x12c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat", cAlternateFileName="{61793~4.DAT")) returned 0 [0203.129] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0203.129] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otele.dat")) returned 1 [0203.130] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otele.dat")) returned 0xffffffff [0203.130] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat", cAlternateFileName="{61793~3.DAT")) returned 1 [0203.130] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otelemediumcost.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0203.131] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otelemediumcost.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0203.131] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x209 [0203.131] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0203.132] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0203.188] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x209, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x209, lpOverlapped=0x0) returned 1 [0203.212] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x210, lpOverlapped=0x0) returned 1 [0203.223] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.289] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.308] CloseHandle (hObject=0xdc) returned 1 [0203.309] CloseHandle (hObject=0xe8) returned 1 [0203.313] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otelemediumcost.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otelemediumcost.dat.ozq0")) returned 0 [0203.314] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otelemediumcost.dat.ozq0")) returned 0x2020 [0203.314] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat", cAlternateFileName="{61793~3.DAT")) returned 0x26dd88 [0203.315] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44005180, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat", cAlternateFileName="{61793~3.DAT")) returned 0 [0203.315] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0203.315] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otelemediumcost.dat")) returned 1 [0203.316] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{61793A19-06A8-458E-B03A-D37C5A818884} (1) - 1060 - winword.exe - OTeleMediumCost.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{61793a19-06a8-458e-b03a-d37c5a818884} (1) - 1060 - winword.exe - otelemediumcost.dat")) returned 0xffffffff [0203.316] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c910ae0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x1c910ae0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x1c910ae0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat", cAlternateFileName="{A7D10~1.DAT")) returned 1 [0203.320] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{a7d1044d-57e2-45b6-8a93-cd389a77d3ac} (0) - 2256 - winword.exe - otele.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0203.321] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{a7d1044d-57e2-45b6-8a93-cd389a77d3ac} (0) - 2256 - winword.exe - otele.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0203.322] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb8 [0203.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0203.322] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0203.413] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xb8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xb8, lpOverlapped=0x0) returned 1 [0203.414] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xc0, lpOverlapped=0x0) returned 1 [0203.415] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.482] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.497] CloseHandle (hObject=0xe8) returned 1 [0203.497] CloseHandle (hObject=0xdc) returned 1 [0203.497] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{a7d1044d-57e2-45b6-8a93-cd389a77d3ac} (0) - 2256 - winword.exe - otele.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{a7d1044d-57e2-45b6-8a93-cd389a77d3ac} (0) - 2256 - winword.exe - otele.dat.ozq0")) returned 0 [0203.498] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{a7d1044d-57e2-45b6-8a93-cd389a77d3ac} (0) - 2256 - winword.exe - otele.dat.ozq0")) returned 0x2020 [0203.498] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c910ae0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x1c910ae0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x1c910ae0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat", cAlternateFileName="{A7D10~1.DAT")) returned 0x26dd88 [0203.498] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c910ae0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x1c910ae0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x1c910ae0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat", cAlternateFileName="{A7D10~1.DAT")) returned 0 [0203.498] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0203.498] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{a7d1044d-57e2-45b6-8a93-cd389a77d3ac} (0) - 2256 - winword.exe - otele.dat")) returned 1 [0203.500] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Office\\OTele\\{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\office\\otele\\{a7d1044d-57e2-45b6-8a93-cd389a77d3ac} (0) - 2256 - winword.exe - otele.dat")) returned 0xffffffff [0203.500] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c910ae0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x1c910ae0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x1c910ae0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0xb8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="{A7D1044D-57E2-45B6-8A93-CD389A77D3AC} (0) - 2256 - winword.exe - OTele.dat", cAlternateFileName="{A7D10~1.DAT")) returned 0 [0203.500] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0203.500] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5bb5ba10, ftCreationTime.dwHighDateTime=0x1d70910, ftLastAccessTime.dwLowDateTime=0x44005180, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x44005180, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c75525f, dwReserved1=0x782e7365, cFileName="OTele", cAlternateFileName="")) returned 0 [0203.500] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0203.500] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x656c6946, dwReserved1=0x61432073, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0203.500] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d324537, dwReserved1=0x36423534, cFileName=".", cAlternateFileName="")) returned 0x274de0 [0203.500] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d324537, dwReserved1=0x36423534, cFileName="..", cAlternateFileName="")) returned 1 [0203.500] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe91c6830, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d324537, dwReserved1=0x36423534, cFileName="17.3.4604.0120", cAlternateFileName="173460~1.012")) returned 1 [0203.501] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe91c6830, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0203.501] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe91c6830, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0203.501] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea64e5f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea77f0f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea77f0f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="af", cAlternateFileName="")) returned 1 [0203.501] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea64e5f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea77f0f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea77f0f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0203.502] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea64e5f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea77f0f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea77f0f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0203.502] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea77f0f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea77f0f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea77f0f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ab0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0203.502] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\af\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0203.503] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\af\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0203.504] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ab0 [0203.504] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0203.504] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0203.563] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ab0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0203.568] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ac0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ac0, lpOverlapped=0x0) returned 1 [0203.571] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.628] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.642] CloseHandle (hObject=0xe8) returned 1 [0203.642] CloseHandle (hObject=0xf8) returned 1 [0203.643] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\af\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\af\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0203.643] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\af\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0203.644] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea77f0f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea77f0f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea77f0f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ab0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0203.644] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea77f0f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea77f0f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea77f0f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ab0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0203.644] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0203.644] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\af\\filesync.localizedresources.dll.mui")) returned 1 [0203.646] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\af\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\af\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0203.646] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea77f0f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea77f0f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea77f0f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ab0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0203.646] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0203.646] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea77f0f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea922010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea922010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="am-et", cAlternateFileName="")) returned 1 [0203.646] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea77f0f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea922010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea922010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0203.646] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea77f0f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea922010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea922010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0203.646] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea922010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea922010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea922010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xf4b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0203.647] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\am-et\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0203.647] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\am-et\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0203.648] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf4b0 [0203.648] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0203.648] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0203.716] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf4b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xf4b0, lpOverlapped=0x0) returned 1 [0203.723] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf4c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xf4c0, lpOverlapped=0x0) returned 1 [0203.726] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.785] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.798] CloseHandle (hObject=0xf8) returned 1 [0203.798] CloseHandle (hObject=0xe8) returned 1 [0203.798] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\am-et\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\am-et\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0203.799] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\am-et\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0203.799] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea922010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea922010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea922010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xf4b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0203.799] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea922010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea922010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea922010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xf4b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0203.799] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0203.799] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\am-et\\filesync.localizedresources.dll.mui")) returned 1 [0203.801] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\am-et\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\am-et\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0203.801] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea922010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea922010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea922010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xf4b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0203.801] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0203.801] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea922010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb2cd970, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb2cd970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="amd64", cAlternateFileName="")) returned 1 [0203.801] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea922010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb2cd970, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb2cd970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0203.801] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea922010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb2cd970, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb2cd970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0203.801] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaaeb090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaaeb090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaaeb090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x48ab0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSyncApi64.dll", cAlternateFileName="FILESY~1.DLL")) returned 1 [0203.801] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncApi64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncapi64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0203.802] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncApi64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncapi64.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0203.802] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48ab0 [0203.803] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0203.803] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0203.855] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x48ab0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x48ab0, lpOverlapped=0x0) returned 1 [0203.868] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x48ac0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x48ac0, lpOverlapped=0x0) returned 1 [0203.875] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0203.930] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0203.943] CloseHandle (hObject=0xe8) returned 1 [0203.944] CloseHandle (hObject=0xf8) returned 1 [0203.944] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncApi64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncapi64.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncApi64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncapi64.dll.ozq0")) returned 0 [0203.944] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncApi64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncapi64.dll.ozq0")) returned 0x2020 [0203.944] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncApi64.dll", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaaeb090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaaeb090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaaeb090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x48ab0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSyncApi64.dll", cAlternateFileName="FILESY~1.DLL")) returned 0x277ef8 [0203.945] FindNextFileA (in: hFindFile=0x277ef8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaaeb090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaaeb090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaaeb090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x48ab0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSyncApi64.dll", cAlternateFileName="FILESY~1.DLL")) returned 0 [0203.945] FindClose (in: hFindFile=0x277ef8 | out: hFindFile=0x277ef8) returned 1 [0203.945] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncApi64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncapi64.dll")) returned 1 [0203.948] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncApi64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncapi64.dll")) returned 0xffffffff [0203.949] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeac8dfb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeac8dfb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeac8dfb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x576b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 1 [0203.949] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncshell64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0203.949] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncshell64.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0203.950] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x576b0 [0203.950] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0203.950] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0204.043] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x576b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x576b0, lpOverlapped=0x0) returned 1 [0204.055] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x576c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x576c0, lpOverlapped=0x0) returned 1 [0204.066] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.123] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.136] CloseHandle (hObject=0xf8) returned 1 [0204.136] CloseHandle (hObject=0xe8) returned 1 [0204.137] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncshell64.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncshell64.dll.ozq0")) returned 0 [0204.137] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncshell64.dll.ozq0")) returned 0x2020 [0204.137] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeac8dfb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeac8dfb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeac8dfb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x576b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 0x277f00 [0204.138] FindNextFileA (in: hFindFile=0x277f00, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeac8dfb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeac8dfb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeac8dfb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x576b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSyncShell64.dll", cAlternateFileName="FILESY~2.DLL")) returned 0 [0204.138] FindClose (in: hFindFile=0x277f00 | out: hFindFile=0x277f00) returned 1 [0204.138] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncshell64.dll")) returned 0 [0204.138] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\filesyncshell64.dll")) returned 0x2020 [0204.138] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaeef5b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaeef5b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x20eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="LoggingPlatform64.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 1 [0204.138] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\LoggingPlatform64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\loggingplatform64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0204.139] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\LoggingPlatform64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\loggingplatform64.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0204.140] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x20eb0 [0204.140] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0204.141] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0204.194] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x20eb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x20eb0, lpOverlapped=0x0) returned 1 [0204.198] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20ec0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x20ec0, lpOverlapped=0x0) returned 1 [0204.202] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.269] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.282] CloseHandle (hObject=0xe8) returned 1 [0204.282] CloseHandle (hObject=0xf8) returned 1 [0204.283] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\LoggingPlatform64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\loggingplatform64.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\LoggingPlatform64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\loggingplatform64.dll.ozq0")) returned 0 [0204.283] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\LoggingPlatform64.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\loggingplatform64.dll.ozq0")) returned 0x2020 [0204.283] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\LoggingPlatform64.dll", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaeef5b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaeef5b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x20eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="LoggingPlatform64.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 0x277f00 [0204.284] FindNextFileA (in: hFindFile=0x277f00, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaeef5b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaeef5b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x20eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="LoggingPlatform64.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 0 [0204.284] FindClose (in: hFindFile=0x277f00 | out: hFindFile=0x277f00) returned 1 [0204.284] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\LoggingPlatform64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\loggingplatform64.dll")) returned 1 [0204.286] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\LoggingPlatform64.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\loggingplatform64.dll")) returned 0xffffffff [0204.286] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb1048f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb1048f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb1048f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xa17c8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="msvcp110.dll", cAlternateFileName="")) returned 1 [0204.286] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcp110.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0204.286] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcp110.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0204.287] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa17c8 [0204.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0204.287] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0204.340] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa17c8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xa17c8, lpOverlapped=0x0) returned 1 [0204.363] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa17d0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xa17d0, lpOverlapped=0x0) returned 1 [0204.381] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.492] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.507] CloseHandle (hObject=0xf8) returned 1 [0204.507] CloseHandle (hObject=0xe8) returned 1 [0204.508] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcp110.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcp110.dll.ozq0")) returned 0 [0204.508] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcp110.dll.ozq0")) returned 0x2020 [0204.508] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb1048f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb1048f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb1048f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xa17c8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="msvcp110.dll", cAlternateFileName="")) returned 0x277ef0 [0204.509] FindNextFileA (in: hFindFile=0x277ef0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb1048f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb1048f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb1048f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xa17c8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="msvcp110.dll", cAlternateFileName="")) returned 0 [0204.509] FindClose (in: hFindFile=0x277ef0 | out: hFindFile=0x277ef0) returned 1 [0204.509] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcp110.dll")) returned 0 [0204.509] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcp110.dll")) returned 0x2020 [0204.509] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb2cd970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb2cd970, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb2cd970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xca5c8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="msvcr110.dll", cAlternateFileName="")) returned 1 [0204.510] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcr110.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0204.510] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcr110.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0204.511] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xca5c8 [0204.511] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0204.512] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0204.571] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xca5c8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xca5c8, lpOverlapped=0x0) returned 1 [0204.594] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xca5d0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xca5d0, lpOverlapped=0x0) returned 1 [0204.614] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.673] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.687] CloseHandle (hObject=0xe8) returned 1 [0204.687] CloseHandle (hObject=0xf8) returned 1 [0204.687] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcr110.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcr110.dll.ozq0")) returned 0 [0204.688] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcr110.dll.ozq0")) returned 0x2020 [0204.688] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb2cd970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb2cd970, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb2cd970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xca5c8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="msvcr110.dll", cAlternateFileName="")) returned 0x277ef0 [0204.688] FindNextFileA (in: hFindFile=0x277ef0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb2cd970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb2cd970, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb2cd970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xca5c8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="msvcr110.dll", cAlternateFileName="")) returned 0 [0204.688] FindClose (in: hFindFile=0x277ef0 | out: hFindFile=0x277ef0) returned 1 [0204.688] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcr110.dll")) returned 0 [0204.689] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\amd64\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\amd64\\msvcr110.dll")) returned 0x2020 [0204.689] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb2cd970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb2cd970, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb2cd970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xca5c8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="msvcr110.dll", cAlternateFileName="")) returned 0 [0204.689] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0204.689] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb2cd970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb4969f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb4969f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6d726f6c, dwReserved1=0x642e3436, cFileName="ar", cAlternateFileName="")) returned 1 [0204.689] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb2cd970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb4969f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb4969f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0204.689] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb2cd970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb4969f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb4969f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0204.689] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb4969f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb4969f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb4969f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x110a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0204.690] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ar\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0204.690] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ar\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0204.691] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110a8 [0204.691] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0204.691] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0204.752] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x110a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x110a8, lpOverlapped=0x0) returned 1 [0204.756] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x110b0, lpOverlapped=0x0) returned 1 [0204.759] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.819] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0204.832] CloseHandle (hObject=0xf8) returned 1 [0204.832] CloseHandle (hObject=0xe8) returned 1 [0204.833] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ar\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ar\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0204.833] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ar\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0204.833] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb4969f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb4969f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb4969f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x110a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0204.834] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb4969f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb4969f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb4969f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x110a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0204.834] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0204.834] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ar\\filesync.localizedresources.dll.mui")) returned 1 [0204.836] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ar\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ar\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0204.836] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb4969f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb4969f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb4969f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x110a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0204.836] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0204.836] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4bcb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb685bd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb685bd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="as-in", cAlternateFileName="")) returned 1 [0204.836] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4bcb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb685bd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb685bd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0204.838] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4bcb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb685bd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb685bd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0204.838] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb685bd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb685bd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb6f7ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0204.838] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\as-in\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0204.839] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\as-in\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0204.840] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12eb0 [0204.840] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0204.841] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0204.922] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12eb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0204.928] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ec0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ec0, lpOverlapped=0x0) returned 1 [0204.931] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0204.993] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.005] CloseHandle (hObject=0xe8) returned 1 [0205.006] CloseHandle (hObject=0xf8) returned 1 [0205.006] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\as-in\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\as-in\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0205.006] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\as-in\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0205.006] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb685bd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb685bd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb6f7ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0205.006] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb685bd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb685bd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb6f7ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0205.007] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0205.007] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\as-in\\filesync.localizedresources.dll.mui")) returned 1 [0205.008] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\as-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\as-in\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0205.008] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb685bd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb685bd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb6f7ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0205.008] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0205.008] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9212af0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9212af0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9212af0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="AutoPlayLogo.png", cAlternateFileName="AUTOPL~1.PNG")) returned 1 [0205.009] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayLogo.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplaylogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0205.009] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayLogo.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplaylogo.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0205.010] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x123c [0205.010] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0205.010] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0205.088] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x123c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x123c, lpOverlapped=0x0) returned 1 [0205.141] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1240, lpOverlapped=0x0) returned 1 [0205.143] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.208] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.240] CloseHandle (hObject=0xdc) returned 1 [0205.240] CloseHandle (hObject=0xf8) returned 1 [0205.240] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayLogo.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplaylogo.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayLogo.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplaylogo.png.ozq0")) returned 0 [0205.241] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayLogo.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplaylogo.png.ozq0")) returned 0x2020 [0205.241] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayLogo.png", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9212af0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9212af0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9212af0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="AutoPlayLogo.png", cAlternateFileName="AUTOPL~1.PNG")) returned 0x26dd88 [0205.241] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9212af0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9212af0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9212af0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="AutoPlayLogo.png", cAlternateFileName="AUTOPL~1.PNG")) returned 0 [0205.242] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0205.242] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayLogo.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplaylogo.png")) returned 1 [0205.243] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayLogo.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplaylogo.png")) returned 0xffffffff [0205.243] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9238c50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9238c50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9238c50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="AutoPlayOptIn.gif", cAlternateFileName="AUTOPL~1.GIF")) returned 1 [0205.244] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.gif" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0205.244] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.gif.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.gif.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0205.245] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d8f6 [0205.245] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0205.245] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0205.323] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5d8f6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x5d8f6, lpOverlapped=0x0) returned 1 [0205.435] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5d900, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x5d900, lpOverlapped=0x0) returned 1 [0205.456] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.536] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.550] CloseHandle (hObject=0xf8) returned 1 [0205.550] CloseHandle (hObject=0xdc) returned 1 [0205.550] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.gif" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.gif"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.gif.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.gif.ozq0")) returned 0 [0205.551] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.gif.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.gif.ozq0")) returned 0x2020 [0205.551] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.gif", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9238c50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9238c50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9238c50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="AutoPlayOptIn.gif", cAlternateFileName="AUTOPL~1.GIF")) returned 0x26dd88 [0205.551] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9238c50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9238c50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9238c50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x5d8f6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="AutoPlayOptIn.gif", cAlternateFileName="AUTOPL~1.GIF")) returned 0 [0205.551] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0205.552] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.gif" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.gif")) returned 1 [0205.556] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.gif" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.gif")) returned 0xffffffff [0205.556] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9238c50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9238c50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9238c50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x27f2, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="AutoPlayOptIn.png", cAlternateFileName="AUTOPL~2.PNG")) returned 1 [0205.556] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0205.557] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0205.557] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27f2 [0205.557] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0205.558] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0205.598] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x27f2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x27f2, lpOverlapped=0x0) returned 1 [0205.601] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2800, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2800, lpOverlapped=0x0) returned 1 [0205.602] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.655] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.668] CloseHandle (hObject=0xdc) returned 1 [0205.668] CloseHandle (hObject=0xf8) returned 1 [0205.668] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.png.ozq0")) returned 0 [0205.669] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.png.ozq0")) returned 0x2020 [0205.669] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.png", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9238c50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9238c50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9238c50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x27f2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="AutoPlayOptIn.png", cAlternateFileName="AUTOPL~2.PNG")) returned 0x26dd88 [0205.669] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9238c50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9238c50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9238c50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x27f2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="AutoPlayOptIn.png", cAlternateFileName="AUTOPL~2.PNG")) returned 0 [0205.669] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0205.669] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.png")) returned 1 [0205.670] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\AutoPlayOptIn.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\autoplayoptin.png")) returned 0xffffffff [0205.670] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb6f7ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb8c1070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb8c1070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="az-latn-az", cAlternateFileName="AZ-LAT~1")) returned 1 [0205.670] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb6f7ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb8c1070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb8c1070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0205.671] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb6f7ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb8c1070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb8c1070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0205.671] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb8c1070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb8c1070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb8c1070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0205.671] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\az-latn-az\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0205.672] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\az-latn-az\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0205.673] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0205.673] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0205.673] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0205.716] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0205.726] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0205.729] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.786] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.798] CloseHandle (hObject=0xdc) returned 1 [0205.798] CloseHandle (hObject=0xe8) returned 1 [0205.799] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\az-latn-az\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\az-latn-az\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0205.799] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\az-latn-az\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0205.799] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb8c1070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb8c1070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb8c1070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0205.799] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb8c1070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb8c1070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb8c1070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0205.799] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0205.800] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\az-latn-az\\filesync.localizedresources.dll.mui")) returned 1 [0205.801] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\az-latn-az\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\az-latn-az\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0205.801] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb8c1070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb8c1070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb8c1070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0205.801] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0205.801] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb8c1070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeba3de30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeba3de30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="be", cAlternateFileName="")) returned 1 [0205.801] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb8c1070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeba3de30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeba3de30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0205.802] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb8c1070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeba3de30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeba3de30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0205.802] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeba3de30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeba3de30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeba3de30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0205.802] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\be\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0205.803] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\be\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0205.804] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124a8 [0205.804] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0205.804] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0205.848] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x124a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x124a8, lpOverlapped=0x0) returned 1 [0205.856] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x124b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x124b0, lpOverlapped=0x0) returned 1 [0205.858] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0205.922] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0205.936] CloseHandle (hObject=0xe8) returned 1 [0205.936] CloseHandle (hObject=0xdc) returned 1 [0205.936] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\be\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\be\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0205.937] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\be\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0205.937] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeba3de30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeba3de30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeba3de30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0205.937] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeba3de30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeba3de30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeba3de30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0205.937] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0205.937] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\be\\filesync.localizedresources.dll.mui")) returned 1 [0205.939] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\be\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\be\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0205.939] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeba3de30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeba3de30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeba3de30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0205.939] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0205.939] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeba3de30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc2d010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc2d010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="bg", cAlternateFileName="")) returned 1 [0205.939] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeba3de30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc2d010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc2d010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0205.940] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeba3de30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc2d010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc2d010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0205.940] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebc2d010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc2d010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc2d010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0205.940] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bg\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0205.942] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bg\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0205.943] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ea8 [0205.943] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0205.943] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0206.037] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ea8, lpOverlapped=0x0) returned 1 [0206.040] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0206.042] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.103] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.115] CloseHandle (hObject=0xdc) returned 1 [0206.116] CloseHandle (hObject=0xe8) returned 1 [0206.116] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bg\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bg\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0206.117] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bg\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0206.117] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebc2d010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc2d010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc2d010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0206.117] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebc2d010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc2d010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc2d010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.117] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0206.117] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bg\\filesync.localizedresources.dll.mui")) returned 1 [0206.118] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bg\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bg\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0206.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebc2d010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc2d010, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc2d010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.118] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0206.119] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebc2d010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebdf6090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebdf6090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="bn-bd", cAlternateFileName="")) returned 1 [0206.119] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebc2d010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebdf6090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebdf6090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0206.119] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebc2d010, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebdf6090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebdf6090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0206.119] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebdf6090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebdf6090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebdf6090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0206.119] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-bd\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0206.121] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-bd\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0206.121] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cb0 [0206.121] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0206.122] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0206.232] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12cb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0206.235] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cc0, lpOverlapped=0x0) returned 1 [0206.239] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.299] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.315] CloseHandle (hObject=0xe8) returned 1 [0206.315] CloseHandle (hObject=0xdc) returned 1 [0206.315] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-bd\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-bd\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0206.316] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-bd\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0206.316] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebdf6090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebdf6090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebdf6090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0206.316] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebdf6090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebdf6090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebdf6090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.316] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0206.316] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-bd\\filesync.localizedresources.dll.mui")) returned 1 [0206.319] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-bd\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-bd\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0206.319] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebdf6090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebdf6090, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebdf6090, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.319] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0206.319] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdf6090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebfbf110, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebfbf110, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="bn-in", cAlternateFileName="")) returned 1 [0206.319] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdf6090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebfbf110, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebfbf110, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0206.320] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdf6090, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebfbf110, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebfbf110, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0206.320] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebfbf110, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebfbf110, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebfbf110, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0206.320] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-in\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0206.322] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-in\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0206.323] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12aa8 [0206.323] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0206.323] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0206.464] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12aa8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12aa8, lpOverlapped=0x0) returned 1 [0206.468] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ab0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0206.470] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.535] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.552] CloseHandle (hObject=0xdc) returned 1 [0206.552] CloseHandle (hObject=0xe8) returned 1 [0206.566] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-in\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-in\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0206.567] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-in\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0206.567] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebfbf110, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebfbf110, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebfbf110, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0206.568] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebfbf110, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebfbf110, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebfbf110, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.568] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0206.568] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-in\\filesync.localizedresources.dll.mui")) returned 1 [0206.570] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bn-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bn-in\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0206.570] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebfbf110, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebfbf110, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebfbf110, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.570] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0206.570] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebfbf110, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec188190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec188190, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="bs-latn-ba", cAlternateFileName="BS-LAT~1")) returned 1 [0206.570] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebfbf110, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec188190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec188190, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0206.571] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebfbf110, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec188190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec188190, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0206.571] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec188190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec188190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec188190, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0206.572] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bs-latn-ba\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0206.573] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bs-latn-ba\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0206.574] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130b0 [0206.574] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0206.574] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0206.701] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0206.705] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130c0, lpOverlapped=0x0) returned 1 [0206.707] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.767] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.780] CloseHandle (hObject=0xe8) returned 1 [0206.780] CloseHandle (hObject=0xdc) returned 1 [0206.781] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bs-latn-ba\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bs-latn-ba\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0206.781] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bs-latn-ba\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0206.781] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec188190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec188190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec188190, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0206.781] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec188190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec188190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec188190, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.781] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0206.782] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bs-latn-ba\\filesync.localizedresources.dll.mui")) returned 1 [0206.783] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\bs-latn-ba\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\bs-latn-ba\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0206.783] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec188190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec188190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec188190, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.783] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0206.784] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec188190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec377370, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec377370, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ca", cAlternateFileName="")) returned 1 [0206.784] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec188190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec377370, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec377370, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0206.784] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec188190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec377370, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec377370, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0206.784] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec377370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec377370, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec377370, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0206.785] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0206.786] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0206.787] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136a8 [0206.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0206.787] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0206.863] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x136a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x136a8, lpOverlapped=0x0) returned 1 [0206.867] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x136b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x136b0, lpOverlapped=0x0) returned 1 [0206.869] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0206.929] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0206.942] CloseHandle (hObject=0xdc) returned 1 [0206.942] CloseHandle (hObject=0xe8) returned 1 [0206.942] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0206.943] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0206.943] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec377370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec377370, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec377370, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0206.943] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec377370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec377370, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec377370, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.943] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0206.944] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca\\filesync.localizedresources.dll.mui")) returned 1 [0206.946] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0206.946] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec377370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec377370, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec377370, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0206.946] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0206.946] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec377370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec5403f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec5403f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ca-es-valencia", cAlternateFileName="CA-ES-~1")) returned 1 [0206.946] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec377370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec5403f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec5403f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0206.947] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec377370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec5403f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec5403f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0206.947] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec5403f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec5403f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec5d8970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0206.947] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca-es-valencia\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0206.947] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca-es-valencia\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0206.948] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136b0 [0206.948] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0206.948] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0207.061] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x136b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x136b0, lpOverlapped=0x0) returned 1 [0207.065] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x136c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x136c0, lpOverlapped=0x0) returned 1 [0207.068] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.125] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.138] CloseHandle (hObject=0xe8) returned 1 [0207.138] CloseHandle (hObject=0xdc) returned 1 [0207.139] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca-es-valencia\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca-es-valencia\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0207.139] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca-es-valencia\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0207.139] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec5403f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec5403f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec5d8970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f30 [0207.139] FindNextFileA (in: hFindFile=0x277f30, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec5403f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec5403f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec5d8970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0207.140] FindClose (in: hFindFile=0x277f30 | out: hFindFile=0x277f30) returned 1 [0207.140] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca-es-valencia\\filesync.localizedresources.dll.mui")) returned 1 [0207.141] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ca-es-valencia\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ca-es-valencia\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0207.141] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec5403f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec5403f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec5d8970, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0207.141] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0207.142] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="CollectOneDriveLogs.bat", cAlternateFileName="COLLEC~1.BAT")) returned 1 [0207.142] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\collectonedrivelogs.bat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0207.142] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\CollectOneDriveLogs.bat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\collectonedrivelogs.bat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0207.143] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16d3 [0207.143] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0207.144] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0207.303] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x16d3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x16d3, lpOverlapped=0x0) returned 1 [0207.306] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x16e0, lpOverlapped=0x0) returned 1 [0207.307] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.363] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.376] CloseHandle (hObject=0xf8) returned 1 [0207.376] CloseHandle (hObject=0xdc) returned 1 [0207.376] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\collectonedrivelogs.bat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\CollectOneDriveLogs.bat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\collectonedrivelogs.bat.ozq0")) returned 0 [0207.377] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\CollectOneDriveLogs.bat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\collectonedrivelogs.bat.ozq0")) returned 0x2020 [0207.377] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\CollectOneDriveLogs.bat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CollectOneDriveLogs.bat", cAlternateFileName="COLLEC~1.BAT")) returned 0x26dd88 [0207.377] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CollectOneDriveLogs.bat", cAlternateFileName="COLLEC~1.BAT")) returned 0 [0207.377] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0207.377] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\collectonedrivelogs.bat")) returned 1 [0207.379] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\CollectOneDriveLogs.bat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\collectonedrivelogs.bat")) returned 0xffffffff [0207.379] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec5d8970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec7a19f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec7a19f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="cs", cAlternateFileName="")) returned 1 [0207.379] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec5d8970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec7a19f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec7a19f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0207.381] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec5d8970, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec7a19f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec7a19f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb600b4, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0207.381] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7a19f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec7a19f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec7a19f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0xb600b4, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0207.382] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cs\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0207.383] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cs\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0207.384] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x128b0 [0207.384] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0207.384] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0207.513] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x128b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x128b0, lpOverlapped=0x0) returned 1 [0207.519] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x128c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x128c0, lpOverlapped=0x0) returned 1 [0207.522] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.582] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.596] CloseHandle (hObject=0xf8) returned 1 [0207.597] CloseHandle (hObject=0xe8) returned 1 [0207.597] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cs\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cs\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0207.602] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cs\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0207.602] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7a19f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec7a19f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec7a19f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0207.604] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7a19f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec7a19f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec7a19f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0207.604] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0207.604] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cs\\filesync.localizedresources.dll.mui")) returned 1 [0207.612] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cs\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0207.613] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7a19f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec7a19f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec7a19f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0xb600b4, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0207.613] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0207.613] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7a19f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec96aa70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec96aa70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="cy-gb", cAlternateFileName="")) returned 1 [0207.614] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7a19f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec96aa70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec96aa70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0207.614] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7a19f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec96aa70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec96aa70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0207.615] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec96aa70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec96aa70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec96aa70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0207.615] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cy-gb\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0207.615] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cy-gb\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0207.616] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12eb0 [0207.616] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0207.617] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0207.776] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12eb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0207.781] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ec0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ec0, lpOverlapped=0x0) returned 1 [0207.784] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0207.842] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0207.855] CloseHandle (hObject=0xe8) returned 1 [0207.855] CloseHandle (hObject=0xf8) returned 1 [0207.855] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cy-gb\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cy-gb\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0207.856] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cy-gb\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0207.856] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec96aa70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec96aa70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec96aa70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0207.856] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec96aa70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec96aa70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec96aa70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0207.856] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0207.856] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cy-gb\\filesync.localizedresources.dll.mui")) returned 1 [0207.858] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\cy-gb\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\cy-gb\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0207.858] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec96aa70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec96aa70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec96aa70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0207.858] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0207.858] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec96aa70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecb7fdb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecb7fdb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="da", cAlternateFileName="")) returned 1 [0207.858] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec96aa70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecb7fdb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecb7fdb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0207.859] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec96aa70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecb7fdb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecb7fdb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0207.859] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb7fdb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecb7fdb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecb7fdb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0207.860] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\da\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0207.861] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\da\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0207.862] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124a8 [0207.862] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0207.863] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0207.991] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x124a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x124a8, lpOverlapped=0x0) returned 1 [0207.996] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x124b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x124b0, lpOverlapped=0x0) returned 1 [0207.999] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.063] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.076] CloseHandle (hObject=0xf8) returned 1 [0208.076] CloseHandle (hObject=0xe8) returned 1 [0208.076] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\da\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\da\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0208.077] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\da\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0208.077] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb7fdb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecb7fdb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecb7fdb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0208.077] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb7fdb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecb7fdb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecb7fdb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.077] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0208.077] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\da\\filesync.localizedresources.dll.mui")) returned 1 [0208.079] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\da\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\da\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0208.079] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb7fdb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecb7fdb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecb7fdb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.079] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0208.079] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb7fdb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecd48e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecd48e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="de", cAlternateFileName="")) returned 1 [0208.079] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb7fdb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecd48e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecd48e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0208.080] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb7fdb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecd48e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecd48e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0208.080] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecd48e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecd48e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecd48e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0208.080] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\de\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0208.081] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\de\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0208.082] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x146a8 [0208.082] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0208.082] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0208.185] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x146a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x146a8, lpOverlapped=0x0) returned 1 [0208.188] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x146b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x146b0, lpOverlapped=0x0) returned 1 [0208.191] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.251] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.266] CloseHandle (hObject=0xe8) returned 1 [0208.266] CloseHandle (hObject=0xf8) returned 1 [0208.266] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\de\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\de\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0208.267] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\de\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0208.267] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecd48e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecd48e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecd48e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0208.267] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecd48e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecd48e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecd48e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.267] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0208.267] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\de\\filesync.localizedresources.dll.mui")) returned 1 [0208.269] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\de\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\de\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0208.269] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecd48e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecd48e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecd48e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.269] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0208.277] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecd48e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecf842d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecf842d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="el", cAlternateFileName="")) returned 1 [0208.277] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecd48e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecf842d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecf842d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0208.277] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecd48e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecf842d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecf842d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0208.277] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecf842d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecf842d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecf842d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x144a0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0208.278] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\el\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0208.279] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\el\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0208.279] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144a0 [0208.279] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0208.280] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0208.394] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x144a0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x144a0, lpOverlapped=0x0) returned 1 [0208.398] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x144b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x144b0, lpOverlapped=0x0) returned 1 [0208.400] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.459] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.473] CloseHandle (hObject=0xf8) returned 1 [0208.473] CloseHandle (hObject=0xe8) returned 1 [0208.473] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\el\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\el\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0208.474] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\el\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0208.474] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecf842d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecf842d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecf842d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x144a0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0208.474] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecf842d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecf842d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecf842d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x144a0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.474] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0208.474] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\el\\filesync.localizedresources.dll.mui")) returned 1 [0208.476] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\el\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\el\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0208.476] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecf842d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecf842d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecf842d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x144a0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.476] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0208.476] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecf842d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed1bf770, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed1bf770, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="en", cAlternateFileName="")) returned 1 [0208.476] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecf842d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed1bf770, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed1bf770, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0208.477] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecf842d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed1bf770, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed1bf770, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0208.477] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed1bf770, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed1bf770, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed1bf770, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0208.477] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0208.479] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0208.480] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116a8 [0208.480] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0208.480] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0208.605] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x116a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x116a8, lpOverlapped=0x0) returned 1 [0208.613] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x116b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x116b0, lpOverlapped=0x0) returned 1 [0208.615] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.676] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.688] CloseHandle (hObject=0xe8) returned 1 [0208.688] CloseHandle (hObject=0xf8) returned 1 [0208.689] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0208.689] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0208.689] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed1bf770, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed1bf770, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed1bf770, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0208.689] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed1bf770, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed1bf770, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed1bf770, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.700] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0208.701] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en\\filesync.localizedresources.dll.mui")) returned 1 [0208.702] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0208.702] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed1bf770, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed1bf770, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed1bf770, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.702] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0208.703] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed1bf770, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed3fac10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed3fac10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="en-gb", cAlternateFileName="")) returned 1 [0208.703] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed1bf770, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed3fac10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed3fac10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0208.703] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed1bf770, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed3fac10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed3fac10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0208.703] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed3fac10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed3fac10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed3fac10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0208.703] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en-gb\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0208.709] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en-gb\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0208.710] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x118b0 [0208.710] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0208.711] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0208.817] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x118b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x118b0, lpOverlapped=0x0) returned 1 [0208.891] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x118c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x118c0, lpOverlapped=0x0) returned 1 [0208.893] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0208.957] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0208.971] CloseHandle (hObject=0xf8) returned 1 [0208.971] CloseHandle (hObject=0xe8) returned 1 [0208.971] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en-gb\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en-gb\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0208.972] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en-gb\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0208.972] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed3fac10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed3fac10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed3fac10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0208.972] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed3fac10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed3fac10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed3fac10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.973] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0208.973] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en-gb\\filesync.localizedresources.dll.mui")) returned 1 [0208.979] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\en-gb\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\en-gb\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0208.979] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed3fac10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed3fac10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed3fac10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0208.979] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0208.979] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed3fac10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed5c3c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed5c3c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="es", cAlternateFileName="")) returned 1 [0208.979] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed3fac10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed5c3c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed5c3c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0208.980] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed3fac10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed5c3c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed5c3c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0208.980] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed5c3c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed5c3c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed5c3c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0208.980] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\es\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0209.069] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\es\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0209.070] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130a8 [0209.070] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0209.070] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0209.115] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130a8, lpOverlapped=0x0) returned 1 [0209.124] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0209.127] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.188] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.203] CloseHandle (hObject=0xe8) returned 1 [0209.203] CloseHandle (hObject=0xf8) returned 1 [0209.204] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\es\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\es\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0209.205] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\es\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0209.205] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed5c3c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed5c3c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed5c3c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0209.205] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed5c3c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed5c3c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed5c3c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0209.205] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0209.205] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\es\\filesync.localizedresources.dll.mui")) returned 1 [0209.207] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\es\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\es\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0209.207] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed5c3c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed5c3c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed5c3c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0209.207] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0209.207] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed5c3c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed825290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed825290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="et", cAlternateFileName="")) returned 1 [0209.207] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed5c3c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed825290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed825290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0209.208] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed5c3c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed825290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed825290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0209.208] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed78cd10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed78cd10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed825290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0209.208] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\et\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0209.210] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\et\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0209.210] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120a8 [0209.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0209.211] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0209.250] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x120a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x120a8, lpOverlapped=0x0) returned 1 [0209.305] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x120b0, lpOverlapped=0x0) returned 1 [0209.307] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.362] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.374] CloseHandle (hObject=0xf8) returned 1 [0209.374] CloseHandle (hObject=0xe8) returned 1 [0209.374] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\et\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\et\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0209.375] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\et\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0209.375] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed78cd10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed78cd10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed825290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0209.375] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed78cd10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed78cd10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed825290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0209.375] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0209.375] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\et\\filesync.localizedresources.dll.mui")) returned 1 [0209.377] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\et\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\et\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0209.377] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed78cd10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed78cd10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed825290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0209.377] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0209.377] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x70a8, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ETWlog.dll", cAlternateFileName="")) returned 1 [0209.378] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ETWlog.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\etwlog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0209.378] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ETWlog.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\etwlog.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0209.379] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70a8 [0209.379] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0209.379] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0209.415] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x70a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x70a8, lpOverlapped=0x0) returned 1 [0209.522] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x70b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x70b0, lpOverlapped=0x0) returned 1 [0209.524] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.579] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.592] CloseHandle (hObject=0xdc) returned 1 [0209.592] CloseHandle (hObject=0xe8) returned 1 [0209.592] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ETWlog.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\etwlog.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ETWlog.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\etwlog.dll.ozq0")) returned 0 [0209.593] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ETWlog.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\etwlog.dll.ozq0")) returned 0x2020 [0209.593] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ETWlog.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x70a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ETWlog.dll", cAlternateFileName="")) returned 0x26dd88 [0209.593] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x70a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ETWlog.dll", cAlternateFileName="")) returned 0 [0209.593] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0209.593] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ETWlog.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\etwlog.dll")) returned 1 [0209.601] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ETWlog.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\etwlog.dll")) returned 0xffffffff [0209.602] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed825290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeda14470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeda14470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="eu", cAlternateFileName="")) returned 1 [0209.602] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed825290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeda14470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeda14470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0209.602] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed825290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeda14470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeda14470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c009a, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0209.602] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeda14470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeda14470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeda14470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x9c009a, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0209.603] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\eu\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0209.604] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\eu\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0209.605] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12aa8 [0209.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0209.605] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0209.641] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12aa8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12aa8, lpOverlapped=0x0) returned 1 [0209.665] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ab0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0209.676] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.784] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0209.809] CloseHandle (hObject=0xdc) returned 1 [0209.810] CloseHandle (hObject=0xf8) returned 1 [0209.810] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\eu\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\eu\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0209.811] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\eu\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0209.811] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeda14470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeda14470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeda14470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0209.811] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeda14470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeda14470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeda14470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0209.811] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0209.811] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\eu\\filesync.localizedresources.dll.mui")) returned 1 [0209.814] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\eu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\eu\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0209.814] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeda14470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeda14470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeda14470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x9c009a, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0209.814] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0209.814] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ExclusionList.xml", cAlternateFileName="EXCLUS~1.XML")) returned 1 [0209.815] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ExclusionList.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\exclusionlist.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0209.815] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ExclusionList.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\exclusionlist.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0209.816] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4e5f [0209.816] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0209.817] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0209.863] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4e5f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4e5f, lpOverlapped=0x0) returned 1 [0209.931] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4e60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4e60, lpOverlapped=0x0) returned 1 [0209.932] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0209.992] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.005] CloseHandle (hObject=0xe8) returned 1 [0210.006] CloseHandle (hObject=0xf8) returned 1 [0210.006] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ExclusionList.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\exclusionlist.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ExclusionList.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\exclusionlist.xml.ozq0")) returned 0 [0210.006] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ExclusionList.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\exclusionlist.xml.ozq0")) returned 0x2020 [0210.006] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ExclusionList.xml", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ExclusionList.xml", cAlternateFileName="EXCLUS~1.XML")) returned 0x26dd88 [0210.007] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe925edb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x4e5f, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ExclusionList.xml", cAlternateFileName="EXCLUS~1.XML")) returned 0 [0210.007] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0210.007] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ExclusionList.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\exclusionlist.xml")) returned 1 [0210.008] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ExclusionList.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\exclusionlist.xml")) returned 0xffffffff [0210.008] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeda14470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedbdd4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedbdd4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fa", cAlternateFileName="")) returned 1 [0210.008] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeda14470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedbdd4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedbdd4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0210.008] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeda14470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedbdd4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedbdd4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0210.008] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xedbdd4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedbdd4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedbdd4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0210.009] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fa\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0210.209] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fa\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0210.210] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cb0 [0210.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0210.210] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0210.245] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12cb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0210.273] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cc0, lpOverlapped=0x0) returned 1 [0210.275] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.337] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.349] CloseHandle (hObject=0xe8) returned 1 [0210.349] CloseHandle (hObject=0xdc) returned 1 [0210.349] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fa\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fa\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0210.350] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fa\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0210.350] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xedbdd4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedbdd4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedbdd4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0210.350] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xedbdd4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedbdd4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedbdd4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0210.350] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0210.350] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fa\\filesync.localizedresources.dll.mui")) returned 1 [0210.352] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fa\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fa\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0210.352] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xedbdd4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedbdd4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedbdd4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0210.352] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0210.352] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xedbdd4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeddcc6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeddcc6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="fi", cAlternateFileName="")) returned 1 [0210.352] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xedbdd4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeddcc6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeddcc6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0210.353] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xedbdd4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeddcc6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeddcc6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0210.353] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeddcc6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeddcc6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeddcc6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0210.353] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fi\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0210.355] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fi\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0210.356] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126b0 [0210.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0210.356] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0210.394] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0210.410] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126c0, lpOverlapped=0x0) returned 1 [0210.413] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.475] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.488] CloseHandle (hObject=0xdc) returned 1 [0210.488] CloseHandle (hObject=0xe8) returned 1 [0210.490] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fi\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fi\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0210.491] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fi\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0210.491] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeddcc6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeddcc6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeddcc6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0210.491] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeddcc6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeddcc6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeddcc6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0210.491] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0210.491] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fi\\filesync.localizedresources.dll.mui")) returned 1 [0210.492] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fi\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0210.492] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeddcc6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeddcc6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeddcc6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0210.493] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0210.493] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeddcc6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee007b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee007b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="fil-ph", cAlternateFileName="")) returned 1 [0210.493] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeddcc6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee007b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee007b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0210.493] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeddcc6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee007b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee007b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0210.493] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee007b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee007b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee007b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0210.493] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fil-ph\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0210.494] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fil-ph\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0210.495] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ca8 [0210.495] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0210.495] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0210.535] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13ca8, lpOverlapped=0x0) returned 1 [0210.576] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13cb0, lpOverlapped=0x0) returned 1 [0210.579] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.631] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.651] CloseHandle (hObject=0xe8) returned 1 [0210.651] CloseHandle (hObject=0xdc) returned 1 [0210.651] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fil-ph\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fil-ph\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0210.651] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fil-ph\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0210.652] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee007b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee007b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee007b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0210.652] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee007b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee007b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee007b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0210.652] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0210.652] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fil-ph\\filesync.localizedresources.dll.mui")) returned 1 [0210.653] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fil-ph\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fil-ph\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0210.653] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee007b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee007b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee007b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0210.653] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0210.653] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9284f10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116a8, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 1 [0210.654] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.localizedresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0210.654] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.LocalizedResources.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.localizedresources.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0210.655] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116a8 [0210.655] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0210.655] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0210.692] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x116a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x116a8, lpOverlapped=0x0) returned 1 [0210.781] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x116b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x116b0, lpOverlapped=0x0) returned 1 [0210.784] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0210.847] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0210.859] CloseHandle (hObject=0xf8) returned 1 [0210.859] CloseHandle (hObject=0xdc) returned 1 [0210.860] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.localizedresources.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.LocalizedResources.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.localizedresources.dll.ozq0")) returned 0 [0210.860] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.LocalizedResources.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.localizedresources.dll.ozq0")) returned 0x2020 [0210.860] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.LocalizedResources.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9284f10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 0x26dd88 [0210.860] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe925edb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe925edb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9284f10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll", cAlternateFileName="FILESY~1.DLL")) returned 0 [0210.861] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0210.861] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.localizedresources.dll")) returned 1 [0210.862] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.LocalizedResources.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.localizedresources.dll")) returned 0xffffffff [0210.862] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe92ab070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe92ab070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe92ab070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2524a8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 1 [0210.862] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.Resources.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.resources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0210.863] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.Resources.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.resources.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0210.863] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2524a8 [0210.863] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0210.863] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0210.900] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2524a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2524a8, lpOverlapped=0x0) returned 1 [0211.109] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2524b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2524b0, lpOverlapped=0x0) returned 1 [0211.173] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.231] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.247] CloseHandle (hObject=0xdc) returned 1 [0211.247] CloseHandle (hObject=0xf8) returned 1 [0211.247] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.Resources.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.resources.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.Resources.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.resources.dll.ozq0")) returned 0 [0211.248] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.Resources.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.resources.dll.ozq0")) returned 0x2020 [0211.248] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.Resources.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe92ab070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe92ab070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe92ab070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2524a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 0x26dd88 [0211.248] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe92ab070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe92ab070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe92ab070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2524a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.Resources.dll", cAlternateFileName="FILESY~2.DLL")) returned 0 [0211.248] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0211.249] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.Resources.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.resources.dll")) returned 1 [0211.253] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSync.Resources.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesync.resources.dll")) returned 0xffffffff [0211.254] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe92d11d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe92d11d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe92d11d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x394a8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="FileSyncApi.dll", cAlternateFileName="FILESY~3.DLL")) returned 1 [0211.254] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncApi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0211.255] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncApi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncapi.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0211.255] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x394a8 [0211.255] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0211.256] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0211.298] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x394a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x394a8, lpOverlapped=0x0) returned 1 [0211.304] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x394b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x394b0, lpOverlapped=0x0) returned 1 [0211.310] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.403] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.419] CloseHandle (hObject=0xf8) returned 1 [0211.419] CloseHandle (hObject=0xdc) returned 1 [0211.421] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncApi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncapi.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncApi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncapi.dll.ozq0")) returned 0 [0211.423] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncApi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncapi.dll.ozq0")) returned 0x2020 [0211.423] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncApi.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe92d11d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe92d11d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe92d11d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x394a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSyncApi.dll", cAlternateFileName="FILESY~3.DLL")) returned 0x26dd88 [0211.423] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe92d11d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe92d11d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe92d11d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x394a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSyncApi.dll", cAlternateFileName="FILESY~3.DLL")) returned 0 [0211.423] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0211.423] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncApi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncapi.dll")) returned 1 [0211.429] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncApi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncapi.dll")) returned 0xffffffff [0211.429] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe931d490, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe931d490, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe931d490, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x16e6a8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="FileSyncClient.dll", cAlternateFileName="FILESY~4.DLL")) returned 1 [0211.526] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncClient.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0211.527] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncClient.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncclient.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0211.528] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16e6a8 [0211.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0211.529] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0211.569] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x16e6a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x16e6a8, lpOverlapped=0x0) returned 1 [0211.633] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x16e6b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x16e6b0, lpOverlapped=0x0) returned 1 [0211.698] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.756] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.772] CloseHandle (hObject=0xdc) returned 1 [0211.772] CloseHandle (hObject=0xf8) returned 1 [0211.772] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncClient.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncclient.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncClient.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncclient.dll.ozq0")) returned 0 [0211.773] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncClient.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncclient.dll.ozq0")) returned 0x2020 [0211.773] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncClient.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe931d490, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe931d490, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe931d490, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x16e6a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSyncClient.dll", cAlternateFileName="FILESY~4.DLL")) returned 0x26dd88 [0211.773] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe931d490, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe931d490, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe931d490, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x16e6a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSyncClient.dll", cAlternateFileName="FILESY~4.DLL")) returned 0 [0211.774] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0211.774] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncClient.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncclient.dll")) returned 1 [0211.780] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncClient.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncclient.dll")) returned 0xffffffff [0211.780] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9369750, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9369750, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9369750, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1b8a8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="FileSyncConfig.exe", cAlternateFileName="FILESY~1.EXE")) returned 1 [0211.780] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncConfig.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncconfig.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0211.781] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncConfig.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncconfig.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0211.781] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b8a8 [0211.781] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0211.782] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0211.841] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1b8a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1b8a8, lpOverlapped=0x0) returned 1 [0211.854] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1b8b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b8b0, lpOverlapped=0x0) returned 1 [0211.858] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0211.920] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0211.935] CloseHandle (hObject=0xf8) returned 1 [0211.935] CloseHandle (hObject=0xdc) returned 1 [0211.935] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncConfig.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncconfig.exe"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncConfig.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncconfig.exe.ozq0")) returned 0 [0211.936] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncConfig.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncconfig.exe.ozq0")) returned 0x2020 [0211.936] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncConfig.exe", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9369750, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9369750, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9369750, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1b8a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSyncConfig.exe", cAlternateFileName="FILESY~1.EXE")) returned 0x26dd88 [0211.936] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9369750, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9369750, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9369750, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1b8a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSyncConfig.exe", cAlternateFileName="FILESY~1.EXE")) returned 0 [0211.937] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0211.937] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncConfig.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncconfig.exe")) returned 1 [0211.939] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncConfig.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncconfig.exe")) returned 0xffffffff [0211.939] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe93b5a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe93b5a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe93b5a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12f0a8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="FileSyncSessions.dll", cAlternateFileName="FIFC38~1.DLL")) returned 1 [0211.939] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncSessions.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncsessions.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0211.940] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncSessions.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncsessions.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0211.941] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12f0a8 [0211.941] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0211.941] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0211.977] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12f0a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x12f0a8, lpOverlapped=0x0) returned 1 [0212.080] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12f0b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x12f0b0, lpOverlapped=0x0) returned 1 [0212.110] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.172] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.187] CloseHandle (hObject=0xdc) returned 1 [0212.187] CloseHandle (hObject=0xf8) returned 1 [0212.188] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncSessions.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncsessions.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncSessions.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncsessions.dll.ozq0")) returned 0 [0212.188] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncSessions.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncsessions.dll.ozq0")) returned 0x2020 [0212.188] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncSessions.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe93b5a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe93b5a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe93b5a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12f0a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSyncSessions.dll", cAlternateFileName="FIFC38~1.DLL")) returned 0x26dd88 [0212.189] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe93b5a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe93b5a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe93b5a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12f0a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSyncSessions.dll", cAlternateFileName="FIFC38~1.DLL")) returned 0 [0212.189] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0212.189] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncSessions.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncsessions.dll")) returned 1 [0212.192] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncSessions.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncsessions.dll")) returned 0xffffffff [0212.192] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9427e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9427e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9427e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x506a0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="FileSyncShell.dll", cAlternateFileName="FI340C~1.DLL")) returned 1 [0212.192] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncshell.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0212.192] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncshell.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0212.193] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x506a0 [0212.193] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0212.193] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0212.225] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x506a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x506a0, lpOverlapped=0x0) returned 1 [0212.366] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x506b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x506b0, lpOverlapped=0x0) returned 1 [0212.373] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.428] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.439] CloseHandle (hObject=0xf8) returned 1 [0212.440] CloseHandle (hObject=0xdc) returned 1 [0212.440] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncshell.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncshell.dll.ozq0")) returned 0 [0212.440] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncshell.dll.ozq0")) returned 0x2020 [0212.441] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9427e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9427e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9427e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x506a0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSyncShell.dll", cAlternateFileName="FI340C~1.DLL")) returned 0x26dd88 [0212.441] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9427e30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9427e30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9427e30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x506a0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSyncShell.dll", cAlternateFileName="FI340C~1.DLL")) returned 0 [0212.441] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0212.441] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncshell.dll")) returned 1 [0212.445] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\FileSyncShell.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\filesyncshell.dll")) returned 0xffffffff [0212.445] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee007b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee1f6d50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee1f6d50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fr", cAlternateFileName="")) returned 1 [0212.445] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee007b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee1f6d50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee1f6d50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0212.446] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee007b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee1f6d50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee1f6d50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0212.446] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee1f6d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee1f6d50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee1f6d50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0212.446] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fr\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0212.462] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fr\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0212.463] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ca8 [0212.463] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0212.463] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0212.498] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13ca8, lpOverlapped=0x0) returned 1 [0212.507] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13cb0, lpOverlapped=0x0) returned 1 [0212.509] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.571] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.583] CloseHandle (hObject=0xf8) returned 1 [0212.583] CloseHandle (hObject=0xe8) returned 1 [0212.584] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fr\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fr\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0212.584] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fr\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0212.584] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee1f6d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee1f6d50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee1f6d50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0212.584] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee1f6d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee1f6d50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee1f6d50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0212.585] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0212.585] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fr\\filesync.localizedresources.dll.mui")) returned 1 [0212.586] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\fr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\fr\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0212.586] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee1f6d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee1f6d50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee1f6d50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0212.586] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0212.586] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1f6d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee967210, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee967210, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ga-ie", cAlternateFileName="")) returned 1 [0212.586] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1f6d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee967210, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee967210, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0212.587] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee1f6d50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee967210, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee967210, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0212.587] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee967210, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee967210, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee967210, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0212.587] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ga-ie\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0212.588] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ga-ie\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0212.589] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136a8 [0212.589] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0212.589] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0212.629] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x136a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x136a8, lpOverlapped=0x0) returned 1 [0212.654] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x136b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x136b0, lpOverlapped=0x0) returned 1 [0212.656] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.721] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.736] CloseHandle (hObject=0xe8) returned 1 [0212.736] CloseHandle (hObject=0xf8) returned 1 [0212.736] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ga-ie\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ga-ie\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0212.737] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ga-ie\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0212.737] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee967210, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee967210, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee967210, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0212.737] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee967210, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee967210, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee967210, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0212.737] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0212.737] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ga-ie\\filesync.localizedresources.dll.mui")) returned 1 [0212.739] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ga-ie\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ga-ie\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0212.739] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee967210, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee967210, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee967210, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0212.739] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0212.739] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee98d370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec14ad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec14ad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="gd", cAlternateFileName="")) returned 1 [0212.739] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee98d370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec14ad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec14ad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0212.739] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee98d370, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec14ad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec14ad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0212.739] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeec14ad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec14ad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec14ad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0212.740] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0212.740] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0212.741] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x146a8 [0212.741] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0212.741] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0212.784] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x146a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x146a8, lpOverlapped=0x0) returned 1 [0212.798] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x146b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x146b0, lpOverlapped=0x0) returned 1 [0212.801] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0212.870] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0212.892] CloseHandle (hObject=0xf8) returned 1 [0212.892] CloseHandle (hObject=0xe8) returned 1 [0212.892] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0212.893] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0212.893] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeec14ad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec14ad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec14ad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0212.893] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeec14ad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec14ad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec14ad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0212.893] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0212.893] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd\\filesync.localizedresources.dll.mui")) returned 1 [0212.895] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0212.895] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeec14ad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec14ad0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec14ad0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0212.895] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0212.896] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeec14ad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeee29e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeee29e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="gd-latn", cAlternateFileName="")) returned 1 [0212.896] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeec14ad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeee29e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeee29e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0212.896] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeec14ad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeee29e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeee29e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0212.896] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeee29e10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeee29e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeee29e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0212.897] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd-latn\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0212.899] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd-latn\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0212.900] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x146a8 [0212.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0212.900] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0212.972] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x146a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x146a8, lpOverlapped=0x0) returned 1 [0212.981] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x146b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x146b0, lpOverlapped=0x0) returned 1 [0212.983] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.043] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.056] CloseHandle (hObject=0xe8) returned 1 [0213.056] CloseHandle (hObject=0xf8) returned 1 [0213.056] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd-latn\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd-latn\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0213.057] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd-latn\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0213.057] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeee29e10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeee29e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeee29e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0213.057] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeee29e10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeee29e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeee29e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.058] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0213.058] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd-latn\\filesync.localizedresources.dll.mui")) returned 1 [0213.060] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gd-latn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gd-latn\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0213.060] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeee29e10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeee29e10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeee29e10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x146a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.060] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0213.060] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeee29e10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeff2e90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeff2e90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="gl", cAlternateFileName="")) returned 1 [0213.060] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeee29e10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeff2e90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeff2e90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0213.060] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeee29e10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeff2e90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeff2e90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0213.061] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeff2e90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeff2e90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeff2e90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0213.061] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gl\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0213.062] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gl\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0213.062] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130a8 [0213.062] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0213.063] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0213.112] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130a8, lpOverlapped=0x0) returned 1 [0213.116] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0213.119] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.178] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.193] CloseHandle (hObject=0xf8) returned 1 [0213.193] CloseHandle (hObject=0xe8) returned 1 [0213.193] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gl\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gl\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0213.194] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gl\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0213.194] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeff2e90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeff2e90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeff2e90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0213.194] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeff2e90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeff2e90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeff2e90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.194] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0213.194] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gl\\filesync.localizedresources.dll.mui")) returned 1 [0213.196] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gl\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0213.196] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeff2e90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeff2e90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeff2e90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.196] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0213.196] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeeff2e90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef1e2070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef1e2070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="gu", cAlternateFileName="")) returned 1 [0213.196] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeeff2e90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef1e2070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef1e2070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0213.197] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeeff2e90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef1e2070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef1e2070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0213.197] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef1e2070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef1e2070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef1e2070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0213.197] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gu\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0213.199] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gu\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0213.200] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126b0 [0213.200] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0213.200] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0213.252] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0213.256] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126c0, lpOverlapped=0x0) returned 1 [0213.259] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.317] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.330] CloseHandle (hObject=0xe8) returned 1 [0213.330] CloseHandle (hObject=0xf8) returned 1 [0213.330] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gu\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gu\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0213.331] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gu\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0213.331] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef1e2070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef1e2070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef1e2070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0213.331] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef1e2070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef1e2070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef1e2070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.331] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0213.331] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gu\\filesync.localizedresources.dll.mui")) returned 1 [0213.333] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\gu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\gu\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0213.333] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef1e2070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef1e2070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef1e2070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.333] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0213.333] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef1e2070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3d1250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3d1250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ha-latn-ng", cAlternateFileName="HA-LAT~1")) returned 1 [0213.333] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef1e2070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3d1250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3d1250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0213.333] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef1e2070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3d1250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3d1250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0213.333] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef3d1250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3d1250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3d1250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0213.334] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ha-latn-ng\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0213.334] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ha-latn-ng\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0213.335] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124b0 [0213.335] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0213.335] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0213.388] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x124b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x124b0, lpOverlapped=0x0) returned 1 [0213.393] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x124c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x124c0, lpOverlapped=0x0) returned 1 [0213.396] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.454] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.468] CloseHandle (hObject=0xf8) returned 1 [0213.468] CloseHandle (hObject=0xe8) returned 1 [0213.468] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ha-latn-ng\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ha-latn-ng\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0213.469] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ha-latn-ng\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0213.469] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef3d1250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3d1250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3d1250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0213.469] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef3d1250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3d1250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3d1250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.469] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0213.469] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ha-latn-ng\\filesync.localizedresources.dll.mui")) returned 1 [0213.471] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ha-latn-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ha-latn-ng\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0213.471] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef3d1250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3d1250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3d1250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.471] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0213.471] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef3d1250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef59a2d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef59a2d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="he", cAlternateFileName="")) returned 1 [0213.471] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef3d1250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef59a2d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef59a2d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0213.471] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef3d1250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef59a2d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef59a2d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0213.471] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef59a2d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef59a2d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef59a2d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x102a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0213.472] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\he\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0213.473] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\he\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0213.473] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x102a8 [0213.473] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0213.474] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0213.525] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x102a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x102a8, lpOverlapped=0x0) returned 1 [0213.615] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x102b0, lpOverlapped=0x0) returned 1 [0213.618] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.697] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.719] CloseHandle (hObject=0xe8) returned 1 [0213.719] CloseHandle (hObject=0xf8) returned 1 [0213.721] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\he\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\he\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0213.723] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\he\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0213.723] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef59a2d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef59a2d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef59a2d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x102a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0213.723] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef59a2d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef59a2d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef59a2d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x102a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.723] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0213.723] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\he\\filesync.localizedresources.dll.mui")) returned 1 [0213.736] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\he\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\he\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0213.736] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef59a2d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef59a2d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef59a2d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x102a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.736] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0213.737] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef632850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef7fb8d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef7fb8d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="hi", cAlternateFileName="")) returned 1 [0213.737] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef632850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef7fb8d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef7fb8d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0213.738] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef632850, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef7fb8d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef7fb8d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0213.738] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef7fb8d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef7fb8d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef7fb8d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0213.738] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hi\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0213.739] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hi\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0213.739] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x128b0 [0213.739] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0213.740] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0213.808] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x128b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x128b0, lpOverlapped=0x0) returned 1 [0213.815] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x128c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x128c0, lpOverlapped=0x0) returned 1 [0213.818] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0213.885] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0213.898] CloseHandle (hObject=0xf8) returned 1 [0213.898] CloseHandle (hObject=0xe8) returned 1 [0213.898] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hi\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hi\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0213.899] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hi\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0213.899] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef7fb8d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef7fb8d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef7fb8d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0213.899] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef7fb8d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef7fb8d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef7fb8d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.899] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0213.899] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hi\\filesync.localizedresources.dll.mui")) returned 1 [0213.901] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hi\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0213.901] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef7fb8d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef7fb8d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef7fb8d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0213.901] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0213.901] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef7fb8d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef9eaab0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef9eaab0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="hr", cAlternateFileName="")) returned 1 [0213.901] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef7fb8d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef9eaab0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef9eaab0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0213.901] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef7fb8d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef9eaab0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef9eaab0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0213.901] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef9eaab0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef9eaab0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef9eaab0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0213.902] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hr\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0214.040] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hr\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0214.041] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ea8 [0214.041] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0214.041] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0214.087] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ea8, lpOverlapped=0x0) returned 1 [0214.094] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0214.097] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.169] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.181] CloseHandle (hObject=0xe8) returned 1 [0214.181] CloseHandle (hObject=0xf8) returned 1 [0214.182] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hr\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hr\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0214.182] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hr\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0214.182] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef9eaab0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef9eaab0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef9eaab0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0214.182] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef9eaab0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef9eaab0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef9eaab0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.182] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0214.182] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hr\\filesync.localizedresources.dll.mui")) returned 1 [0214.184] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hr\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0214.184] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef9eaab0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef9eaab0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef9eaab0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.184] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0214.184] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef9eaab0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefbb3b30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefbb3b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="hu", cAlternateFileName="")) returned 1 [0214.184] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef9eaab0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefbb3b30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefbb3b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0214.185] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef9eaab0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefbb3b30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefbb3b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0214.185] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefbb3b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefbb3b30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefbb3b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0214.185] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hu\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0214.227] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hu\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0214.227] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cb0 [0214.227] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0214.228] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0214.275] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12cb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0214.278] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cc0, lpOverlapped=0x0) returned 1 [0214.281] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.338] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.352] CloseHandle (hObject=0xf8) returned 1 [0214.352] CloseHandle (hObject=0xe8) returned 1 [0214.352] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hu\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hu\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0214.354] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hu\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0214.354] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefbb3b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefbb3b30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefbb3b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0214.354] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefbb3b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefbb3b30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefbb3b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.354] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0214.354] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hu\\filesync.localizedresources.dll.mui")) returned 1 [0214.356] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hu\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0214.356] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefbb3b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefbb3b30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefbb3b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.356] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0214.356] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefbb3b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefda2d10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefda2d10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="hy", cAlternateFileName="")) returned 1 [0214.356] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefbb3b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefda2d10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefda2d10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0214.356] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefbb3b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefda2d10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefda2d10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0214.356] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefda2d10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefda2d10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefda2d10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0214.357] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hy\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0214.358] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hy\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0214.358] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120b0 [0214.359] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0214.359] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0214.405] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x120b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x120b0, lpOverlapped=0x0) returned 1 [0214.408] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x120c0, lpOverlapped=0x0) returned 1 [0214.410] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.471] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.483] CloseHandle (hObject=0xe8) returned 1 [0214.483] CloseHandle (hObject=0xf8) returned 1 [0214.483] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hy\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hy\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0214.483] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hy\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0214.484] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefda2d10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefda2d10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefda2d10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0214.484] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefda2d10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefda2d10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefda2d10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.484] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0214.484] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hy\\filesync.localizedresources.dll.mui")) returned 1 [0214.485] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\hy\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\hy\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0214.485] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefda2d10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefda2d10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefda2d10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.485] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0214.485] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefda2d10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeff91ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeff91ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="id", cAlternateFileName="")) returned 1 [0214.485] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefda2d10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeff91ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeff91ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0214.486] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefda2d10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeff91ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeff91ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0214.486] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeff91ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeff91ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeff91ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0214.486] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\id\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0214.487] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\id\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0214.488] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120b0 [0214.488] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0214.488] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0214.531] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x120b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x120b0, lpOverlapped=0x0) returned 1 [0214.534] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x120c0, lpOverlapped=0x0) returned 1 [0214.536] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.595] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.611] CloseHandle (hObject=0xf8) returned 1 [0214.611] CloseHandle (hObject=0xe8) returned 1 [0214.611] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\id\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\id\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0214.612] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\id\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0214.612] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeff91ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeff91ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeff91ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0214.612] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeff91ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeff91ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeff91ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.612] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0214.612] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\id\\filesync.localizedresources.dll.mui")) returned 1 [0214.614] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\id\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\id\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0214.614] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeff91ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeff91ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeff91ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.614] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0214.614] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeff91ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01f34f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01f34f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ig-ng", cAlternateFileName="")) returned 1 [0214.614] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeff91ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01f34f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01f34f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0214.615] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeff91ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01f34f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01f34f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0214.615] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf01f34f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01f34f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01f34f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x10eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0214.615] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ig-ng\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0214.645] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ig-ng\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0214.645] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10eb0 [0214.645] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0214.646] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0214.706] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10eb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x10eb0, lpOverlapped=0x0) returned 1 [0214.719] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10ec0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x10ec0, lpOverlapped=0x0) returned 1 [0214.721] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.781] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.794] CloseHandle (hObject=0xe8) returned 1 [0214.794] CloseHandle (hObject=0xf8) returned 1 [0214.794] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ig-ng\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ig-ng\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0214.794] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ig-ng\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0214.795] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf01f34f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01f34f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01f34f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x10eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0214.795] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf01f34f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01f34f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01f34f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x10eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.795] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0214.795] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ig-ng\\filesync.localizedresources.dll.mui")) returned 1 [0214.796] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ig-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ig-ng\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0214.796] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf01f34f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01f34f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01f34f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x10eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.796] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0214.796] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01f34f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf03e26d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf03e26d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="is", cAlternateFileName="")) returned 1 [0214.797] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01f34f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf03e26d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf03e26d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0214.797] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01f34f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf03e26d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf03e26d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0214.797] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf03e26d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf03e26d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf03e26d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0214.797] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\is\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0214.798] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\is\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0214.811] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122b0 [0214.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0214.811] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0214.857] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x122b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x122b0, lpOverlapped=0x0) returned 1 [0214.861] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x122c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x122c0, lpOverlapped=0x0) returned 1 [0214.864] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0214.942] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0214.955] CloseHandle (hObject=0xf8) returned 1 [0214.955] CloseHandle (hObject=0xe8) returned 1 [0214.956] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\is\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\is\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0214.956] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\is\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0214.956] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf03e26d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf03e26d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf03e26d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0214.957] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf03e26d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf03e26d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf03e26d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.957] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0214.957] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\is\\filesync.localizedresources.dll.mui")) returned 1 [0214.959] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\is\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\is\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0214.959] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf03e26d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf03e26d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf03e26d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0214.959] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0214.959] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe995ce50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9b25ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9b25ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="it", cAlternateFileName="")) returned 1 [0214.959] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe995ce50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9b25ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9b25ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0214.961] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe995ce50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9b25ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9b25ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0214.961] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9b25ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9b25ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9b25ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0214.961] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\it\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0214.962] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\it\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0214.963] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12eb0 [0214.963] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0214.963] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0215.013] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12eb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0215.018] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ec0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ec0, lpOverlapped=0x0) returned 1 [0215.020] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.080] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.094] CloseHandle (hObject=0xe8) returned 1 [0215.094] CloseHandle (hObject=0xf8) returned 1 [0215.095] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\it\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\it\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0215.095] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\it\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0215.095] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9b25ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9b25ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9b25ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0215.096] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9b25ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9b25ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9b25ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.096] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0215.096] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\it\\filesync.localizedresources.dll.mui")) returned 1 [0215.097] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\it\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\it\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0215.097] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9b25ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9b25ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9b25ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.098] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0215.098] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9b25ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea081050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea081050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="iu-latn-ca", cAlternateFileName="IU-LAT~1")) returned 1 [0215.098] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9b25ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea081050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea081050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0215.104] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9b25ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea081050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea081050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0215.104] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea081050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea081050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea081050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0215.105] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\iu-latn-ca\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0215.105] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\iu-latn-ca\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0215.106] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x118a8 [0215.106] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0215.106] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0215.165] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x118a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x118a8, lpOverlapped=0x0) returned 1 [0215.252] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x118b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x118b0, lpOverlapped=0x0) returned 1 [0215.254] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.314] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.327] CloseHandle (hObject=0xf8) returned 1 [0215.327] CloseHandle (hObject=0xe8) returned 1 [0215.327] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\iu-latn-ca\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\iu-latn-ca\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0215.328] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\iu-latn-ca\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0215.328] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea081050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea081050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea081050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0215.328] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea081050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea081050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea081050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.328] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0215.328] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\iu-latn-ca\\filesync.localizedresources.dll.mui")) returned 1 [0215.329] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\iu-latn-ca\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\iu-latn-ca\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0215.329] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea081050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea081050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea081050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.329] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0215.330] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea081050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea24a0d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea24a0d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ja", cAlternateFileName="")) returned 1 [0215.330] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea081050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea24a0d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea24a0d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0215.331] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea081050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea24a0d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea24a0d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0215.331] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea24a0d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea24a0d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea24a0d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xe0a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0215.331] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ja\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0215.331] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ja\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0215.332] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0a8 [0215.332] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0215.332] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0215.378] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe0a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xe0a8, lpOverlapped=0x0) returned 1 [0215.381] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe0b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xe0b0, lpOverlapped=0x0) returned 1 [0215.384] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.444] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.456] CloseHandle (hObject=0xe8) returned 1 [0215.456] CloseHandle (hObject=0xf8) returned 1 [0215.456] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ja\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ja\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0215.457] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ja\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0215.457] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea24a0d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea24a0d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea24a0d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xe0a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0215.457] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea24a0d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea24a0d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea24a0d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xe0a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.457] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0215.457] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ja\\filesync.localizedresources.dll.mui")) returned 1 [0215.459] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ja\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ja\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0215.459] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea24a0d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea24a0d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea24a0d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xe0a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.459] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0215.459] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea24a0d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea45f410, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea45f410, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ka", cAlternateFileName="")) returned 1 [0215.459] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea24a0d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea45f410, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea45f410, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0215.459] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea24a0d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea45f410, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea45f410, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0215.459] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea45f410, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea45f410, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea45f410, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x134b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0215.460] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ka\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0215.461] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ka\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0215.461] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x134b0 [0215.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0215.462] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0215.509] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x134b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x134b0, lpOverlapped=0x0) returned 1 [0215.514] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x134c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x134c0, lpOverlapped=0x0) returned 1 [0215.517] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.579] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.594] CloseHandle (hObject=0xf8) returned 1 [0215.594] CloseHandle (hObject=0xe8) returned 1 [0215.595] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ka\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ka\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0215.595] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ka\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0215.595] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea45f410, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea45f410, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea45f410, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x134b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0215.595] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea45f410, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea45f410, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea45f410, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x134b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.596] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0215.596] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ka\\filesync.localizedresources.dll.mui")) returned 1 [0215.597] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ka\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ka\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0215.597] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea45f410, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea45f410, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea45f410, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x134b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.597] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0215.597] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea45f410, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea6c0a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea6c0a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="kk", cAlternateFileName="")) returned 1 [0215.597] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea45f410, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea6c0a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea6c0a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0215.598] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea45f410, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea6c0a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea6c0a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0215.598] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea6c0a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea6c0a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea6c0a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0215.598] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kk\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0215.599] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kk\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0215.599] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cb0 [0215.599] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0215.599] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0215.647] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12cb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0215.693] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cc0, lpOverlapped=0x0) returned 1 [0215.696] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.772] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.787] CloseHandle (hObject=0xe8) returned 1 [0215.787] CloseHandle (hObject=0xf8) returned 1 [0215.787] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kk\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kk\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0215.790] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kk\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0215.790] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea6c0a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea6c0a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea6c0a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0215.790] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea6c0a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea6c0a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea6c0a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.790] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0215.790] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kk\\filesync.localizedresources.dll.mui")) returned 1 [0215.792] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kk\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0215.792] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea6c0a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea6c0a10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea6c0a10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.792] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0215.792] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6c0a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea8afbf0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea8afbf0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="km-kh", cAlternateFileName="")) returned 1 [0215.792] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6c0a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea8afbf0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea8afbf0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0215.792] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6c0a10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea8afbf0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea8afbf0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0215.793] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea8afbf0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea8afbf0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea8afbf0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0215.793] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\km-kh\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0215.793] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\km-kh\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0215.794] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0215.794] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0215.794] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0215.849] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0215.913] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0215.915] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0215.979] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0215.992] CloseHandle (hObject=0xf8) returned 1 [0215.992] CloseHandle (hObject=0xe8) returned 1 [0215.992] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\km-kh\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\km-kh\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0215.993] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\km-kh\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0215.993] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea8afbf0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea8afbf0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea8afbf0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0215.993] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea8afbf0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea8afbf0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea8afbf0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.993] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0215.993] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\km-kh\\filesync.localizedresources.dll.mui")) returned 1 [0215.995] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\km-kh\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\km-kh\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0215.995] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea8afbf0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea8afbf0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea8afbf0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0215.995] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0215.995] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea8afbf0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaa9edd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaa9edd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="kn", cAlternateFileName="")) returned 1 [0215.995] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea8afbf0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaa9edd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaa9edd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0215.995] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea8afbf0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaa9edd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaa9edd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0215.995] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaa9edd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaa9edd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeab111f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ab0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0215.996] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kn\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0215.996] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kn\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0216.013] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ab0 [0216.014] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0216.014] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0216.081] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13ab0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13ab0, lpOverlapped=0x0) returned 1 [0216.165] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13ac0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13ac0, lpOverlapped=0x0) returned 1 [0216.167] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.237] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.263] CloseHandle (hObject=0xe8) returned 1 [0216.263] CloseHandle (hObject=0xf8) returned 1 [0216.267] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kn\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kn\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0216.268] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kn\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0216.268] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaa9edd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaa9edd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeab111f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ab0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0216.268] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaa9edd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaa9edd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeab111f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ab0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0216.268] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0216.269] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kn\\filesync.localizedresources.dll.mui")) returned 1 [0216.270] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kn\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0216.271] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaa9edd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaa9edd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeab111f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ab0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0216.271] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0216.271] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab111f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeacda270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeacda270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ko", cAlternateFileName="")) returned 1 [0216.271] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab111f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeacda270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeacda270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0216.272] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab111f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeacda270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeacda270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0216.272] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeacda270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeacda270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeacda270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xd8b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0216.279] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ko\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0216.280] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ko\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0216.281] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd8b0 [0216.281] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0216.281] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0216.332] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd8b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xd8b0, lpOverlapped=0x0) returned 1 [0216.565] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd8c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xd8c0, lpOverlapped=0x0) returned 1 [0216.567] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.624] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.635] CloseHandle (hObject=0xf8) returned 1 [0216.636] CloseHandle (hObject=0xe8) returned 1 [0216.636] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ko\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ko\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0216.636] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ko\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0216.636] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeacda270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeacda270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeacda270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xd8b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0216.637] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeacda270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeacda270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeacda270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xd8b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0216.637] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0216.637] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ko\\filesync.localizedresources.dll.mui")) returned 1 [0216.638] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ko\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ko\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0216.638] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeacda270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeacda270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeacda270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xd8b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0216.638] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0216.638] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeacda270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaeef5b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="kok", cAlternateFileName="")) returned 1 [0216.638] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeacda270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaeef5b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0216.639] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeacda270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaeef5b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0216.639] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaeef5b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaf619d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0216.639] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kok\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0216.639] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kok\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0216.640] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126a8 [0216.640] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0216.640] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0216.679] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126a8, lpOverlapped=0x0) returned 1 [0216.698] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0216.700] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0216.784] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0216.800] CloseHandle (hObject=0xe8) returned 1 [0216.800] CloseHandle (hObject=0xf8) returned 1 [0216.800] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kok\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kok\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0216.801] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kok\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0216.801] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaeef5b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaf619d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0216.802] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaeef5b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaf619d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0216.802] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0216.802] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kok\\filesync.localizedresources.dll.mui")) returned 1 [0216.804] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\kok\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\kok\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0216.804] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeaeef5b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeaeef5b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeaf619d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0216.804] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0216.804] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaf619d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb19ce70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb19ce70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ku-arab", cAlternateFileName="")) returned 1 [0216.804] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaf619d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb19ce70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb19ce70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0216.805] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaf619d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb19ce70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb19ce70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0216.805] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb19ce70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb19ce70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb19ce70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0216.805] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ku-arab\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0216.806] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ku-arab\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0216.806] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cb0 [0216.806] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0216.807] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0216.855] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12cb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0216.941] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cc0, lpOverlapped=0x0) returned 1 [0216.944] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.007] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.023] CloseHandle (hObject=0xf8) returned 1 [0217.023] CloseHandle (hObject=0xe8) returned 1 [0217.023] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ku-arab\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ku-arab\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0217.024] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ku-arab\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0217.024] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb19ce70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb19ce70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb19ce70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0217.024] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb19ce70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb19ce70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb19ce70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.025] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0217.025] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ku-arab\\filesync.localizedresources.dll.mui")) returned 1 [0217.026] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ku-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ku-arab\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0217.027] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb19ce70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb19ce70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb19ce70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.027] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0217.027] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb19ce70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb3fe470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb3fe470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ky", cAlternateFileName="")) returned 1 [0217.027] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb19ce70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb3fe470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb3fe470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0217.027] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb19ce70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb3fe470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb3fe470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0217.027] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb3fe470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb3fe470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb3fe470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0217.028] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ky\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0217.028] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ky\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0217.029] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0217.029] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0217.029] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0217.074] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0217.199] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0217.201] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.252] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.263] CloseHandle (hObject=0xe8) returned 1 [0217.263] CloseHandle (hObject=0xf8) returned 1 [0217.264] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ky\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ky\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0217.264] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ky\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0217.264] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb3fe470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb3fe470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb3fe470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0217.264] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb3fe470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb3fe470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb3fe470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.264] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0217.264] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ky\\filesync.localizedresources.dll.mui")) returned 1 [0217.266] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ky\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ky\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0217.266] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb3fe470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb3fe470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb3fe470, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.266] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0217.266] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb3fe470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb5ed650, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb5ed650, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="lb-lu", cAlternateFileName="")) returned 1 [0217.266] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb3fe470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb5ed650, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb5ed650, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0217.266] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb3fe470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb5ed650, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb5ed650, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0217.266] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb5ed650, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb5ed650, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb5ed650, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0217.267] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lb-lu\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0217.267] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lb-lu\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0217.267] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ea8 [0217.267] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0217.268] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0217.294] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13ea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13ea8, lpOverlapped=0x0) returned 1 [0217.297] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13eb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13eb0, lpOverlapped=0x0) returned 1 [0217.299] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.360] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.372] CloseHandle (hObject=0xf8) returned 1 [0217.372] CloseHandle (hObject=0xe8) returned 1 [0217.372] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lb-lu\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lb-lu\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0217.373] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lb-lu\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0217.373] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb5ed650, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb5ed650, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb5ed650, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ea8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0217.373] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb5ed650, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb5ed650, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb5ed650, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ea8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.373] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0217.373] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lb-lu\\filesync.localizedresources.dll.mui")) returned 1 [0217.374] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lb-lu\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lb-lu\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0217.374] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb5ed650, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb5ed650, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb5ed650, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.374] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0217.375] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe94740f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe94740f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe94740f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1aca8, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="LoggingPlatform.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 1 [0217.375] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\LoggingPlatform.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\loggingplatform.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0217.375] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\LoggingPlatform.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\loggingplatform.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0217.376] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1aca8 [0217.376] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0217.376] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0217.402] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1aca8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1aca8, lpOverlapped=0x0) returned 1 [0217.417] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1acb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1acb0, lpOverlapped=0x0) returned 1 [0217.420] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.501] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.513] CloseHandle (hObject=0xdc) returned 1 [0217.513] CloseHandle (hObject=0xe8) returned 1 [0217.513] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\LoggingPlatform.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\loggingplatform.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\LoggingPlatform.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\loggingplatform.dll.ozq0")) returned 0 [0217.513] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\LoggingPlatform.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\loggingplatform.dll.ozq0")) returned 0x2020 [0217.514] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\LoggingPlatform.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe94740f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe94740f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe94740f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1aca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="LoggingPlatform.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 0x26dd88 [0217.514] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe94740f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe94740f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe94740f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1aca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="LoggingPlatform.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 0 [0217.514] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0217.514] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\LoggingPlatform.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\loggingplatform.dll")) returned 1 [0217.515] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\LoggingPlatform.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\loggingplatform.dll")) returned 0xffffffff [0217.515] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb5ed650, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb84ec50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb84ec50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="lt", cAlternateFileName="")) returned 1 [0217.515] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb5ed650, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb84ec50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb84ec50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae00ac, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0217.516] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb5ed650, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb84ec50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb84ec50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae00ac, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0217.516] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb84ec50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb84ec50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb84ec50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0xae00ac, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0217.516] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lt\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0217.516] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lt\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0217.517] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130a8 [0217.517] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0217.517] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0217.553] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130a8, lpOverlapped=0x0) returned 1 [0217.564] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0217.567] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.634] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.648] CloseHandle (hObject=0xdc) returned 1 [0217.648] CloseHandle (hObject=0xf8) returned 1 [0217.648] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lt\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lt\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0217.649] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lt\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0217.649] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb84ec50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb84ec50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb84ec50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0217.649] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb84ec50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb84ec50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb84ec50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.649] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0217.649] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lt\\filesync.localizedresources.dll.mui")) returned 1 [0217.651] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lt\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0217.651] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeb84ec50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeb84ec50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeb84ec50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0xae00ac, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.651] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0217.651] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb84ec50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebab0250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebab0250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="lv", cAlternateFileName="")) returned 1 [0217.651] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb84ec50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebab0250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebab0250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0217.651] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb84ec50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebab0250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebab0250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0217.651] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebab0250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebab0250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebab0250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0217.652] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lv\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0217.652] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lv\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0217.653] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12eb0 [0217.653] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0217.653] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0217.693] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12eb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0217.699] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ec0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ec0, lpOverlapped=0x0) returned 1 [0217.701] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0217.760] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0217.771] CloseHandle (hObject=0xf8) returned 1 [0217.771] CloseHandle (hObject=0xdc) returned 1 [0217.772] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lv\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lv\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0217.772] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lv\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0217.772] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebab0250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebab0250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebab0250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0217.772] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebab0250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebab0250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebab0250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.772] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0217.773] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lv\\filesync.localizedresources.dll.mui")) returned 1 [0217.774] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\lv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\lv\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0217.774] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebab0250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebab0250, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebab0250, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0217.774] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0217.774] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebab0250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc792d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc792d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="mi-nz", cAlternateFileName="")) returned 1 [0217.774] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebab0250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc792d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc792d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0217.774] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebab0250, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc792d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc792d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0217.774] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebc792d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc792d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc792d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0217.775] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mi-nz\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0217.775] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mi-nz\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0217.776] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126b0 [0217.776] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0217.776] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0217.812] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0217.974] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126c0, lpOverlapped=0x0) returned 1 [0217.976] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.030] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.042] CloseHandle (hObject=0xdc) returned 1 [0218.042] CloseHandle (hObject=0xf8) returned 1 [0218.043] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mi-nz\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mi-nz\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0218.043] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mi-nz\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0218.043] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebc792d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc792d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc792d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0218.044] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebc792d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc792d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc792d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.044] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0218.044] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mi-nz\\filesync.localizedresources.dll.mui")) returned 1 [0218.045] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mi-nz\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mi-nz\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0218.045] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebc792d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebc792d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebc792d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.045] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0218.045] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebc792d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebe684b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebe684b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="mk", cAlternateFileName="")) returned 1 [0218.045] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebc792d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebe684b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebe684b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0218.046] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebc792d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebe684b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebe684b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0218.046] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebe684b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebe684b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebe684b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0218.046] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mk\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0218.046] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mk\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0218.047] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ea8 [0218.047] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0218.047] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0218.085] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ea8, lpOverlapped=0x0) returned 1 [0218.099] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0218.101] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.170] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.181] CloseHandle (hObject=0xf8) returned 1 [0218.182] CloseHandle (hObject=0xdc) returned 1 [0218.182] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mk\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mk\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0218.182] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mk\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0218.182] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebe684b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebe684b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebe684b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0218.183] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebe684b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebe684b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebe684b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.183] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0218.183] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mk\\filesync.localizedresources.dll.mui")) returned 1 [0218.184] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mk\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0218.184] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xebe684b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xebe684b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xebe684b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.184] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0218.184] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebe684b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec057690, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec057690, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ml-in", cAlternateFileName="")) returned 1 [0218.184] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebe684b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec057690, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec057690, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0218.185] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebe684b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec057690, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec057690, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0218.185] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec057690, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec057690, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec057690, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x14eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0218.185] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ml-in\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0218.186] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ml-in\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0218.186] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14eb0 [0218.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0218.186] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0218.236] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x14eb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x14eb0, lpOverlapped=0x0) returned 1 [0218.245] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x14ec0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x14ec0, lpOverlapped=0x0) returned 1 [0218.247] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.309] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.321] CloseHandle (hObject=0xdc) returned 1 [0218.321] CloseHandle (hObject=0xf8) returned 1 [0218.321] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ml-in\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ml-in\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0218.322] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ml-in\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0218.322] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec057690, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec057690, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec057690, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x14eb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0218.322] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec057690, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec057690, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec057690, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x14eb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.322] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0218.322] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ml-in\\filesync.localizedresources.dll.mui")) returned 1 [0218.324] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ml-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ml-in\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0218.324] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec057690, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec057690, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec057690, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x14eb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.324] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0218.324] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec057690, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec2b8c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec2b8c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="mn", cAlternateFileName="")) returned 1 [0218.335] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec057690, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec2b8c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec2b8c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0218.336] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec057690, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec2b8c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec2b8c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0218.336] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec2b8c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec2b8c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec2b8c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0218.336] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mn\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0218.336] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mn\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0218.337] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0218.337] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0218.337] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0218.378] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0218.387] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0218.389] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.447] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.459] CloseHandle (hObject=0xf8) returned 1 [0218.459] CloseHandle (hObject=0xdc) returned 1 [0218.459] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mn\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mn\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0218.460] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mn\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0218.460] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec2b8c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec2b8c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec2b8c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0218.460] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec2b8c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec2b8c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec2b8c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.460] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0218.460] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mn\\filesync.localizedresources.dll.mui")) returned 1 [0218.462] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mn\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0218.462] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec2b8c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec2b8c90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec2b8c90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.462] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0218.462] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2b8c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec4a7e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec4a7e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="mr", cAlternateFileName="")) returned 1 [0218.462] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2b8c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec4a7e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec4a7e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0218.462] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2b8c90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec4a7e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec4a7e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0218.462] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec4a7e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec4a7e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec4a7e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0218.463] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mr\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0218.463] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mr\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0218.464] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12aa8 [0218.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0218.464] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0218.506] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12aa8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12aa8, lpOverlapped=0x0) returned 1 [0218.539] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ab0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0218.541] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.601] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.613] CloseHandle (hObject=0xdc) returned 1 [0218.613] CloseHandle (hObject=0xf8) returned 1 [0218.613] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mr\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mr\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0218.615] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mr\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0218.615] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec4a7e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec4a7e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec4a7e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0218.615] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec4a7e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec4a7e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec4a7e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.615] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0218.615] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mr\\filesync.localizedresources.dll.mui")) returned 1 [0218.617] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mr\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0218.617] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec4a7e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec4a7e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec4a7e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.617] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0218.617] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec5403f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec755730, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec755730, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ms", cAlternateFileName="")) returned 1 [0218.617] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec5403f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec755730, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec755730, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0218.618] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec5403f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec755730, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec755730, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0218.618] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec755730, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec755730, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec755730, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0218.618] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ms\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0218.619] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ms\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0218.619] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cb0 [0218.619] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0218.620] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0218.665] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12cb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0218.785] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cc0, lpOverlapped=0x0) returned 1 [0218.787] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0218.862] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0218.874] CloseHandle (hObject=0xf8) returned 1 [0218.874] CloseHandle (hObject=0xdc) returned 1 [0218.875] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ms\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ms\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0218.875] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ms\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0218.875] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec755730, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec755730, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec755730, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0218.876] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec755730, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec755730, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec755730, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.876] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0218.876] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ms\\filesync.localizedresources.dll.mui")) returned 1 [0218.877] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ms\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ms\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0218.877] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec755730, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xec755730, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xec755730, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0218.877] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0218.878] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe950c670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe950c670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe950c670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x827d0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="msvcp110.dll", cAlternateFileName="")) returned 1 [0218.878] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcp110.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0218.878] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcp110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcp110.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0218.879] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x827d0 [0218.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0218.879] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0218.934] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x827d0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x827d0, lpOverlapped=0x0) returned 1 [0218.946] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x827e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x827e0, lpOverlapped=0x0) returned 1 [0218.959] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.022] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.037] CloseHandle (hObject=0xe8) returned 1 [0219.038] CloseHandle (hObject=0xdc) returned 1 [0219.038] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcp110.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcp110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcp110.dll.ozq0")) returned 0 [0219.039] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcp110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcp110.dll.ozq0")) returned 0x2020 [0219.039] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcp110.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe950c670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe950c670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe950c670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x827d0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="msvcp110.dll", cAlternateFileName="")) returned 0x26dd88 [0219.039] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe950c670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe950c670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe950c670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x827d0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="msvcp110.dll", cAlternateFileName="")) returned 0 [0219.039] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0219.039] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcp110.dll")) returned 1 [0219.046] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcp110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcp110.dll")) returned 0xffffffff [0219.046] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe957ea90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe957ea90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe957ea90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xd29c8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="msvcr110.dll", cAlternateFileName="")) returned 1 [0219.047] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcr110.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0219.048] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcr110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcr110.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0219.049] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd29c8 [0219.049] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0219.050] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0219.103] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd29c8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd29c8, lpOverlapped=0x0) returned 1 [0219.129] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd29d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd29d0, lpOverlapped=0x0) returned 1 [0219.149] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.213] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.227] CloseHandle (hObject=0xdc) returned 1 [0219.227] CloseHandle (hObject=0xe8) returned 1 [0219.227] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcr110.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcr110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcr110.dll.ozq0")) returned 0 [0219.228] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcr110.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcr110.dll.ozq0")) returned 0x2020 [0219.228] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcr110.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe957ea90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe957ea90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe957ea90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xd29c8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="msvcr110.dll", cAlternateFileName="")) returned 0x26dd88 [0219.229] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe957ea90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe957ea90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe957ea90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xd29c8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="msvcr110.dll", cAlternateFileName="")) returned 0 [0219.229] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0219.229] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcr110.dll")) returned 1 [0219.238] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\msvcr110.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\msvcr110.dll")) returned 0xffffffff [0219.238] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec755730, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeca02ff0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeca02ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="mt-mt", cAlternateFileName="")) returned 1 [0219.238] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec755730, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeca02ff0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeca02ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0219.239] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec755730, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeca02ff0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeca02ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0009e, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0219.239] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca02ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeca02ff0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeca02ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0xa0009e, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0219.239] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mt-mt\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0219.240] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mt-mt\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0219.241] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0219.241] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0219.241] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0219.305] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0219.309] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0219.312] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.367] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.379] CloseHandle (hObject=0xdc) returned 1 [0219.379] CloseHandle (hObject=0xf8) returned 1 [0219.379] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mt-mt\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mt-mt\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0219.379] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mt-mt\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0219.380] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca02ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeca02ff0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeca02ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0219.380] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca02ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeca02ff0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeca02ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0219.380] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0219.380] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mt-mt\\filesync.localizedresources.dll.mui")) returned 1 [0219.381] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\mt-mt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\mt-mt\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0219.381] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeca02ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeca02ff0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeca02ff0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0xa0009e, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0219.381] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0219.381] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeca02ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecc18330, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecc18330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="nb-no", cAlternateFileName="")) returned 1 [0219.381] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeca02ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecc18330, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecc18330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0219.382] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeca02ff0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecc18330, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecc18330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0219.382] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecc18330, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecc18330, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecc18330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0219.382] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nb-no\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0219.383] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nb-no\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0219.383] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x120a8 [0219.383] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0219.383] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0219.426] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x120a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x120a8, lpOverlapped=0x0) returned 1 [0219.431] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x120b0, lpOverlapped=0x0) returned 1 [0219.434] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.501] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.513] CloseHandle (hObject=0xf8) returned 1 [0219.513] CloseHandle (hObject=0xdc) returned 1 [0219.514] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nb-no\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nb-no\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0219.514] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nb-no\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0219.514] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecc18330, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecc18330, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecc18330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0219.514] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecc18330, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecc18330, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecc18330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0219.514] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0219.515] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nb-no\\filesync.localizedresources.dll.mui")) returned 1 [0219.517] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nb-no\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nb-no\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0219.517] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecc18330, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xecc18330, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xecc18330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x120a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0219.517] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0219.517] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecc18330, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xece9fa90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xece9fa90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ne-np", cAlternateFileName="")) returned 1 [0219.517] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecc18330, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xece9fa90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xece9fa90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0219.517] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecc18330, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xece9fa90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xece9fa90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0219.517] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece9fa90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xece9fa90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xece9fa90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0219.518] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ne-np\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0219.518] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ne-np\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0219.519] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130b0 [0219.519] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0219.519] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0219.564] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0219.580] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130c0, lpOverlapped=0x0) returned 1 [0219.583] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.649] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.664] CloseHandle (hObject=0xdc) returned 1 [0219.664] CloseHandle (hObject=0xf8) returned 1 [0219.665] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ne-np\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ne-np\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0219.666] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ne-np\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0219.667] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece9fa90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xece9fa90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xece9fa90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0219.667] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece9fa90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xece9fa90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xece9fa90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0219.667] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0219.667] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ne-np\\filesync.localizedresources.dll.mui")) returned 1 [0219.669] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ne-np\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ne-np\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0219.669] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece9fa90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xece9fa90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xece9fa90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0219.669] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0219.669] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xece9fa90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed14d350, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed14d350, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="nl", cAlternateFileName="")) returned 1 [0219.669] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xece9fa90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed14d350, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed14d350, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0219.670] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xece9fa90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed14d350, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed14d350, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0219.670] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed14d350, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed14d350, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed14d350, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0219.671] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nl\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0219.671] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nl\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0219.672] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132b0 [0219.672] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0219.672] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0219.729] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x132b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x132b0, lpOverlapped=0x0) returned 1 [0219.736] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x132c0, lpOverlapped=0x0) returned 1 [0219.740] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0219.799] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0219.810] CloseHandle (hObject=0xf8) returned 1 [0219.811] CloseHandle (hObject=0xdc) returned 1 [0219.811] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nl\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nl\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0219.811] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nl\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0219.812] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed14d350, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed14d350, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed14d350, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0219.812] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed14d350, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed14d350, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed14d350, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0219.812] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0219.812] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nl\\filesync.localizedresources.dll.mui")) returned 1 [0219.814] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nl\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0219.815] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed14d350, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed14d350, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed14d350, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0219.815] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0219.815] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed14d350, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed33c530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed33c530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="nn-no", cAlternateFileName="")) returned 1 [0219.815] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed14d350, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed33c530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed33c530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0219.815] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed14d350, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed33c530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed33c530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0219.815] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed33c530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed33c530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed33c530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x11ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0219.815] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nn-no\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0219.816] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nn-no\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0219.816] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11ea8 [0219.816] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0219.817] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0219.860] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11ea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x11ea8, lpOverlapped=0x0) returned 1 [0220.002] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x11eb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x11eb0, lpOverlapped=0x0) returned 1 [0220.004] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.068] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.080] CloseHandle (hObject=0xdc) returned 1 [0220.080] CloseHandle (hObject=0xf8) returned 1 [0220.080] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nn-no\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nn-no\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0220.081] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nn-no\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0220.081] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed33c530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed33c530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed33c530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x11ea8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0220.081] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed33c530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed33c530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed33c530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x11ea8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0220.081] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0220.081] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nn-no\\filesync.localizedresources.dll.mui")) returned 1 [0220.083] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nn-no\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nn-no\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0220.083] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed33c530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed33c530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed33c530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x11ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0220.083] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0220.083] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed33c530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed551870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed551870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="nso-za", cAlternateFileName="")) returned 1 [0220.083] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed33c530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed551870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed551870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0220.083] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed33c530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed551870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed551870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0220.083] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed551870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed551870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed551870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ab0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0220.084] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nso-za\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0220.084] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nso-za\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0220.085] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ab0 [0220.085] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0220.085] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0220.128] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13ab0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13ab0, lpOverlapped=0x0) returned 1 [0220.150] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13ac0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13ac0, lpOverlapped=0x0) returned 1 [0220.153] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.216] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.231] CloseHandle (hObject=0xf8) returned 1 [0220.231] CloseHandle (hObject=0xdc) returned 1 [0220.231] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nso-za\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nso-za\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0220.232] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nso-za\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0220.232] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed551870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed551870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed551870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ab0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0220.232] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed551870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed551870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed551870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ab0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0220.232] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0220.232] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nso-za\\filesync.localizedresources.dll.mui")) returned 1 [0220.234] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\nso-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\nso-za\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0220.234] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed551870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed551870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed551870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ab0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0220.234] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0220.234] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26feb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xbffe0770, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x6e22a8, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="OneDriveSetup.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 1 [0220.235] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\OneDriveSetup.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\onedrivesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0220.235] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\OneDriveSetup.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\onedrivesetup.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0220.236] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6e22a8 [0220.236] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0220.236] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0220.283] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x500000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0220.469] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500000, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500000, lpOverlapped=0x0) returned 1 [0220.628] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1e22a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1e22a8, lpOverlapped=0x0) returned 1 [0220.666] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1e22b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1e22b0, lpOverlapped=0x0) returned 1 [0220.709] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.767] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.778] CloseHandle (hObject=0xe8) returned 1 [0220.779] CloseHandle (hObject=0xdc) returned 1 [0220.779] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\OneDriveSetup.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\onedrivesetup.exe"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\OneDriveSetup.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\onedrivesetup.exe.ozq0")) returned 0 [0220.780] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\OneDriveSetup.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\onedrivesetup.exe.ozq0")) returned 0x2020 [0220.780] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\OneDriveSetup.exe", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26feb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xbffe0770, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x6e22a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="OneDriveSetup.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 0x26dd88 [0220.780] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26feb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xbffe0770, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x6e22a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="OneDriveSetup.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 0 [0220.780] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0220.780] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\OneDriveSetup.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\onedrivesetup.exe")) returned 1 [0220.789] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\OneDriveSetup.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\onedrivesetup.exe")) returned 0xffffffff [0220.789] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed551870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed7b2e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed7b2e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="or-in", cAlternateFileName="")) returned 1 [0220.789] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed551870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed7b2e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed7b2e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0220.790] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed551870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed7b2e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed7b2e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0220.790] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed7b2e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed7b2e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed7b2e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0220.790] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\or-in\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0220.790] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\or-in\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0220.791] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ca8 [0220.791] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0220.791] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0220.853] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13ca8, lpOverlapped=0x0) returned 1 [0220.870] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13cb0, lpOverlapped=0x0) returned 1 [0220.873] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0220.941] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0220.953] CloseHandle (hObject=0xe8) returned 1 [0220.953] CloseHandle (hObject=0xf8) returned 1 [0220.954] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\or-in\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\or-in\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0220.954] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\or-in\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0220.954] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed7b2e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed7b2e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed7b2e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0220.954] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed7b2e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed7b2e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed7b2e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0220.954] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0220.954] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\or-in\\filesync.localizedresources.dll.mui")) returned 1 [0220.956] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\or-in\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\or-in\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0220.956] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed7b2e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed7b2e70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed7b2e70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0xaa00a8, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0220.956] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0220.956] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed7b2e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed9ee310, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed9ee310, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="pa", cAlternateFileName="")) returned 1 [0220.956] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed7b2e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed9ee310, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed9ee310, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0220.957] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed7b2e70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed9ee310, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed9ee310, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0220.957] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed9ee310, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed9ee310, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed9ee310, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0220.957] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0220.957] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0220.958] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0220.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0220.958] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0221.001] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0221.018] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0221.020] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.094] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.105] CloseHandle (hObject=0xf8) returned 1 [0221.105] CloseHandle (hObject=0xe8) returned 1 [0221.105] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0221.106] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0221.106] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed9ee310, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed9ee310, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed9ee310, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0221.106] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed9ee310, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed9ee310, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed9ee310, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.106] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0221.106] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa\\filesync.localizedresources.dll.mui")) returned 1 [0221.108] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0221.108] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed9ee310, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xed9ee310, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xed9ee310, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.108] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0221.108] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed9ee310, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedc4f910, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedc4f910, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="pa-arab", cAlternateFileName="")) returned 1 [0221.108] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed9ee310, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedc4f910, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedc4f910, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0221.109] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xed9ee310, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedc4f910, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedc4f910, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0221.109] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xedc4f910, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedc4f910, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedc4f910, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0221.109] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0221.109] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0221.110] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0221.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0221.110] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0221.151] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0221.171] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0221.174] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.241] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.252] CloseHandle (hObject=0xe8) returned 1 [0221.253] CloseHandle (hObject=0xf8) returned 1 [0221.253] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0221.253] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0221.253] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xedc4f910, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedc4f910, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedc4f910, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0221.254] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xedc4f910, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedc4f910, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedc4f910, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.254] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0221.254] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab\\filesync.localizedresources.dll.mui")) returned 1 [0221.255] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0221.255] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xedc4f910, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xedc4f910, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xedc4f910, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.255] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0221.261] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xedc4f910, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeded7070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeded7070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="pa-arab-pk", cAlternateFileName="PA-ARA~1")) returned 1 [0221.261] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xedc4f910, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeded7070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeded7070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0221.261] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xedc4f910, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeded7070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeded7070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0221.261] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeded7070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeded7070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeded7070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0221.262] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab-pk\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0221.262] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab-pk\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0221.262] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0221.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0221.263] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0221.302] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0221.319] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0221.322] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.385] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.397] CloseHandle (hObject=0xf8) returned 1 [0221.397] CloseHandle (hObject=0xe8) returned 1 [0221.397] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab-pk\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab-pk\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0221.397] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab-pk\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0221.398] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeded7070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeded7070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeded7070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0221.398] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeded7070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeded7070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeded7070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.398] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0221.398] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab-pk\\filesync.localizedresources.dll.mui")) returned 1 [0221.399] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pa-arab-pk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pa-arab-pk\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0221.399] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeded7070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeded7070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeded7070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.399] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0221.399] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeded7070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee138670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee138670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="pl", cAlternateFileName="")) returned 1 [0221.399] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeded7070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee138670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee138670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0221.400] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeded7070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee138670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee138670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0221.400] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee138670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee138670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee138670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0221.400] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pl\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0221.400] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pl\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0221.401] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13aa8 [0221.401] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0221.401] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0221.438] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13aa8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13aa8, lpOverlapped=0x0) returned 1 [0221.480] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13ab0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13ab0, lpOverlapped=0x0) returned 1 [0221.483] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.547] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.558] CloseHandle (hObject=0xe8) returned 1 [0221.558] CloseHandle (hObject=0xf8) returned 1 [0221.558] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pl\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pl\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0221.559] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pl\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0221.559] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee138670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee138670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee138670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13aa8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0221.562] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee138670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee138670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee138670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13aa8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.562] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0221.563] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pl\\filesync.localizedresources.dll.mui")) returned 1 [0221.564] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pl\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0221.564] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee138670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee138670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee138670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.564] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0221.564] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee138670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee2b5430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee2b5430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="prs-af", cAlternateFileName="")) returned 1 [0221.564] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee138670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee2b5430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee2b5430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0221.565] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee138670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee2b5430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee2b5430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0221.565] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee2b5430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee2b5430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee7c42f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0221.565] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\prs-af\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0221.565] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\prs-af\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0221.570] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12aa8 [0221.570] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0221.571] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0221.616] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12aa8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12aa8, lpOverlapped=0x0) returned 1 [0221.704] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ab0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0221.709] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.799] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.822] CloseHandle (hObject=0xf8) returned 1 [0221.822] CloseHandle (hObject=0xe8) returned 1 [0221.822] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\prs-af\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\prs-af\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0221.823] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\prs-af\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0221.823] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee2b5430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee2b5430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee7c42f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0221.824] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee2b5430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee2b5430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee7c42f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.824] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0221.824] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\prs-af\\filesync.localizedresources.dll.mui")) returned 1 [0221.828] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\prs-af\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\prs-af\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0221.828] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee2b5430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee2b5430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee7c42f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.828] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0221.828] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee7c42f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee9ff790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee9ff790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="pt-br", cAlternateFileName="")) returned 1 [0221.828] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee7c42f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee9ff790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee9ff790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0221.829] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee7c42f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee9ff790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee9ff790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0221.829] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee9ff790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee9ff790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee9ff790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0221.829] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-br\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0221.830] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-br\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0221.831] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12aa0 [0221.831] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0221.831] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0221.895] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12aa0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12aa0, lpOverlapped=0x0) returned 1 [0221.900] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ab0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0221.902] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0221.964] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0221.979] CloseHandle (hObject=0xe8) returned 1 [0221.979] CloseHandle (hObject=0xf8) returned 1 [0221.980] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-br\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-br\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0221.980] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-br\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0221.980] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee9ff790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee9ff790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee9ff790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0221.981] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee9ff790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee9ff790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee9ff790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.996] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0221.996] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-br\\filesync.localizedresources.dll.mui")) returned 1 [0221.998] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-br\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-br\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0221.998] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee9ff790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xee9ff790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xee9ff790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0221.998] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0221.998] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee9ff790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec86ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec86ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0221.998] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee9ff790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec86ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec86ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0221.999] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xee9ff790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec86ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec86ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0221.999] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeec86ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec86ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec86ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0221.999] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-pt\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0221.999] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-pt\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0222.000] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ea0 [0222.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0222.000] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0222.048] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ea0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ea0, lpOverlapped=0x0) returned 1 [0222.052] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0222.054] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.109] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.124] CloseHandle (hObject=0xf8) returned 1 [0222.124] CloseHandle (hObject=0xe8) returned 1 [0222.124] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-pt\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-pt\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0222.124] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-pt\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0222.125] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeec86ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec86ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec86ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0222.125] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeec86ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec86ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec86ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0222.125] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0222.125] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-pt\\filesync.localizedresources.dll.mui")) returned 1 [0222.126] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\pt-pt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\pt-pt\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0222.126] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeec86ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeec86ef0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeec86ef0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0222.127] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0222.127] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeec86ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeec2390, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeec2390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="qut-latn", cAlternateFileName="")) returned 1 [0222.127] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeec86ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeec2390, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeec2390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0222.127] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeec86ef0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeec2390, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeec2390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0222.127] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeec2390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeec2390, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeec2390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x148a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0222.127] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\qut-latn\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0222.128] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\qut-latn\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0222.128] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x148a8 [0222.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0222.129] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0222.185] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x148a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x148a8, lpOverlapped=0x0) returned 1 [0222.225] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x148b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x148b0, lpOverlapped=0x0) returned 1 [0222.228] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.284] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.298] CloseHandle (hObject=0xe8) returned 1 [0222.298] CloseHandle (hObject=0xf8) returned 1 [0222.298] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\qut-latn\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\qut-latn\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0222.299] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\qut-latn\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0222.299] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeec2390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeec2390, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeec2390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x148a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0222.299] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeec2390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeec2390, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeec2390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x148a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0222.299] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0222.299] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\qut-latn\\filesync.localizedresources.dll.mui")) returned 1 [0222.301] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\qut-latn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\qut-latn\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0222.301] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeeec2390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeeec2390, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeeec2390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x148a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0222.301] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0222.301] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeeec2390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef195db0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef195db0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="quz-pe", cAlternateFileName="")) returned 1 [0222.301] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeeec2390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef195db0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef195db0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0222.301] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeeec2390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef195db0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef195db0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0222.301] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef195db0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef195db0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef195db0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0222.302] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\quz-pe\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0222.302] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\quz-pe\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0222.302] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130a8 [0222.302] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0222.303] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0222.365] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130a8, lpOverlapped=0x0) returned 1 [0222.454] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0222.457] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.510] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.522] CloseHandle (hObject=0xf8) returned 1 [0222.522] CloseHandle (hObject=0xe8) returned 1 [0222.523] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\quz-pe\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\quz-pe\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0222.523] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\quz-pe\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0222.523] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef195db0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef195db0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef195db0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0222.524] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef195db0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef195db0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef195db0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0222.524] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0222.524] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\quz-pe\\filesync.localizedresources.dll.mui")) returned 1 [0222.526] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\quz-pe\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\quz-pe\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0222.526] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef195db0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef195db0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef195db0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0222.526] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0222.526] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9689430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9689430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe96af590, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xb9ca8, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="RemoteAccess.dll", cAlternateFileName="REMOTE~1.DLL")) returned 1 [0222.526] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\RemoteAccess.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\remoteaccess.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.528] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\RemoteAccess.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\remoteaccess.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0222.528] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9ca8 [0222.528] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0222.529] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0222.568] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0xb9ca8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xb9ca8, lpOverlapped=0x0) returned 1 [0222.599] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb9cb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xb9cb0, lpOverlapped=0x0) returned 1 [0222.616] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.675] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.689] CloseHandle (hObject=0xdc) returned 1 [0222.690] CloseHandle (hObject=0xe8) returned 1 [0222.690] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\RemoteAccess.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\remoteaccess.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\RemoteAccess.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\remoteaccess.dll.ozq0")) returned 0 [0222.690] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\RemoteAccess.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\remoteaccess.dll.ozq0")) returned 0x2020 [0222.691] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\RemoteAccess.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9689430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9689430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe96af590, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xb9ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="RemoteAccess.dll", cAlternateFileName="REMOTE~1.DLL")) returned 0x26dd88 [0222.691] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9689430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9689430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe96af590, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xb9ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="RemoteAccess.dll", cAlternateFileName="REMOTE~1.DLL")) returned 0 [0222.691] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0222.691] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\RemoteAccess.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\remoteaccess.dll")) returned 1 [0222.698] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\RemoteAccess.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\remoteaccess.dll")) returned 0xffffffff [0222.698] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef195db0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3f73b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3f73b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ro", cAlternateFileName="")) returned 1 [0222.698] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef195db0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3f73b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3f73b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0222.699] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef195db0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3f73b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3f73b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0222.699] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef3f73b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3f73b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3f73b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0xa800a6, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0222.699] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ro\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.699] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ro\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0222.700] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130b0 [0222.700] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0222.700] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0222.752] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0222.818] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130c0, lpOverlapped=0x0) returned 1 [0222.820] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0222.879] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0222.892] CloseHandle (hObject=0xdc) returned 1 [0222.892] CloseHandle (hObject=0xf8) returned 1 [0222.892] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ro\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ro\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0222.892] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ro\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0222.893] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef3f73b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3f73b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3f73b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0222.900] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef3f73b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3f73b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3f73b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0222.900] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0222.900] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ro\\filesync.localizedresources.dll.mui")) returned 1 [0222.902] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ro\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ro\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0222.902] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef3f73b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef3f73b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef3f73b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0xa800a6, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0222.902] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0222.902] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef3f73b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef60c6f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef60c6f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ru", cAlternateFileName="")) returned 1 [0222.902] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef3f73b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef60c6f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef60c6f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0222.902] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef3f73b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef60c6f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef60c6f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0222.902] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef60c6f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef60c6f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef60c6f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0222.903] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ru\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0222.903] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ru\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0222.903] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126a8 [0222.903] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0222.904] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0222.959] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126a8, lpOverlapped=0x0) returned 1 [0222.973] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0222.984] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.048] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.061] CloseHandle (hObject=0xf8) returned 1 [0223.061] CloseHandle (hObject=0xdc) returned 1 [0223.061] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ru\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ru\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0223.062] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ru\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0223.062] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef60c6f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef60c6f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef60c6f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0223.062] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef60c6f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef60c6f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef60c6f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0223.062] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0223.062] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ru\\filesync.localizedresources.dll.mui")) returned 1 [0223.063] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ru\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ru\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0223.063] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef60c6f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef60c6f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef60c6f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0223.063] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0223.063] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef60c6f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef893e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef893e50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="rw", cAlternateFileName="")) returned 1 [0223.063] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef60c6f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef893e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef893e50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0223.064] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef60c6f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef893e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef893e50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0223.064] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef893e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef893e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef893e50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0223.064] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\rw\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0223.064] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\rw\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0223.065] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126a8 [0223.065] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0223.065] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0223.116] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126a8, lpOverlapped=0x0) returned 1 [0223.153] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0223.156] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.228] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.239] CloseHandle (hObject=0xdc) returned 1 [0223.240] CloseHandle (hObject=0xf8) returned 1 [0223.240] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\rw\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\rw\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0223.241] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\rw\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0223.242] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef893e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef893e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef893e50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0223.242] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef893e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef893e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef893e50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0223.242] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0223.242] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\rw\\filesync.localizedresources.dll.mui")) returned 1 [0223.244] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\rw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\rw\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0223.244] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xef893e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xef893e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xef893e50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0223.244] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0223.244] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe97219b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe97219b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe97219b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124b, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ScreenshotLogo.png", cAlternateFileName="SCREEN~1.PNG")) returned 1 [0223.244] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotLogo.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotlogo.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0223.245] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotLogo.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotlogo.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0223.246] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x124b [0223.246] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0223.246] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0223.320] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x124b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x124b, lpOverlapped=0x0) returned 1 [0223.384] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1250, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1250, lpOverlapped=0x0) returned 1 [0223.385] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0223.446] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0223.458] CloseHandle (hObject=0xe8) returned 1 [0223.458] CloseHandle (hObject=0xf8) returned 1 [0223.459] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotLogo.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotlogo.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotLogo.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotlogo.png.ozq0")) returned 0 [0223.459] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotLogo.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotlogo.png.ozq0")) returned 0x2020 [0223.459] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotLogo.png", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe97219b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe97219b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe97219b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ScreenshotLogo.png", cAlternateFileName="SCREEN~1.PNG")) returned 0x26dd88 [0223.459] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe97219b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe97219b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe97219b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x124b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ScreenshotLogo.png", cAlternateFileName="SCREEN~1.PNG")) returned 0 [0223.459] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0223.460] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotLogo.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotlogo.png")) returned 1 [0223.461] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotLogo.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotlogo.png")) returned 0xffffffff [0223.461] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe98eaa30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe98eaa30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9910b90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x6c00a, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ScreenshotOptIn.png", cAlternateFileName="SCREEN~2.PNG")) returned 1 [0223.461] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotOptIn.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotoptin.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0223.461] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotOptIn.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotoptin.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0223.462] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c00a [0223.462] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0223.462] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0223.498] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6c00a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x6c00a, lpOverlapped=0x0) returned 1 [0223.929] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6c010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x6c010, lpOverlapped=0x0) returned 1 [0223.938] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.010] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.023] CloseHandle (hObject=0xf8) returned 1 [0224.023] CloseHandle (hObject=0xe8) returned 1 [0224.023] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotOptIn.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotoptin.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotOptIn.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotoptin.png.ozq0")) returned 0 [0224.024] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotOptIn.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotoptin.png.ozq0")) returned 0x2020 [0224.024] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotOptIn.png", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe98eaa30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe98eaa30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9910b90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x6c00a, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ScreenshotOptIn.png", cAlternateFileName="SCREEN~2.PNG")) returned 0x26dd88 [0224.024] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe98eaa30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe98eaa30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9910b90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x6c00a, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ScreenshotOptIn.png", cAlternateFileName="SCREEN~2.PNG")) returned 0 [0224.024] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0224.024] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotOptIn.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotoptin.png")) returned 1 [0224.029] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ScreenshotOptIn.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\screenshotoptin.png")) returned 0xffffffff [0224.029] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef893e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefa83030, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefa83030, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="sd-arab", cAlternateFileName="")) returned 1 [0224.029] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef893e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefa83030, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefa83030, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae00ac, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0224.029] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xef893e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefa83030, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefa83030, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae00ac, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0224.029] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefa83030, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefa83030, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefa83030, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0xae00ac, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0224.030] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0224.030] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0224.031] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12aa8 [0224.031] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0224.031] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0224.071] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12aa8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12aa8, lpOverlapped=0x0) returned 1 [0224.079] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ab0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0224.082] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.155] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.171] CloseHandle (hObject=0xf8) returned 1 [0224.171] CloseHandle (hObject=0xdc) returned 1 [0224.172] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0224.172] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0224.173] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefa83030, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefa83030, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefa83030, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0224.173] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefa83030, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefa83030, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefa83030, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.173] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0224.173] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab\\filesync.localizedresources.dll.mui")) returned 1 [0224.175] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0224.175] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefa83030, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefa83030, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefa83030, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0xae00ac, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.175] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0224.175] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefa83030, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefd0a790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefd0a790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sd-arab-pk", cAlternateFileName="SD-ARA~1")) returned 1 [0224.175] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefa83030, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefd0a790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefd0a790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0224.176] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefa83030, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefd0a790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefd0a790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0224.176] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefd0a790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefd0a790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefd0a790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0224.176] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab-pk\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0224.176] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab-pk\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0224.177] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12aa8 [0224.177] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0224.177] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0224.222] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12aa8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12aa8, lpOverlapped=0x0) returned 1 [0224.236] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ab0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0224.239] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.302] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.315] CloseHandle (hObject=0xdc) returned 1 [0224.316] CloseHandle (hObject=0xf8) returned 1 [0224.316] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab-pk\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab-pk\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0224.316] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab-pk\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0224.316] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefd0a790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefd0a790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefd0a790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0224.317] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefd0a790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefd0a790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefd0a790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.317] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0224.317] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab-pk\\filesync.localizedresources.dll.mui")) returned 1 [0224.318] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sd-arab-pk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sd-arab-pk\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0224.319] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefd0a790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xefd0a790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xefd0a790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12aa8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.319] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0224.319] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefd0a790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeffb8050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeffb8050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="si-lk", cAlternateFileName="")) returned 1 [0224.319] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefd0a790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeffb8050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeffb8050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0224.319] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xefd0a790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeffb8050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeffb8050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0224.319] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeffb8050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeffb8050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeffb8050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0224.320] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\si-lk\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0224.320] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\si-lk\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0224.322] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126a8 [0224.322] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0224.322] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0224.373] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126a8, lpOverlapped=0x0) returned 1 [0224.419] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0224.421] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.496] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.507] CloseHandle (hObject=0xf8) returned 1 [0224.507] CloseHandle (hObject=0xdc) returned 1 [0224.507] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\si-lk\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\si-lk\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0224.508] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\si-lk\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0224.508] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeffb8050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeffb8050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeffb8050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0224.509] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeffb8050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeffb8050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeffb8050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.509] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0224.509] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\si-lk\\filesync.localizedresources.dll.mui")) returned 1 [0224.510] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\si-lk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\si-lk\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0224.510] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xeffb8050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xeffb8050, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xeffb8050, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.510] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0224.510] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeffb8050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01a7230, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01a7230, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sk", cAlternateFileName="")) returned 1 [0224.510] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeffb8050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01a7230, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01a7230, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0224.511] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeffb8050, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01a7230, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01a7230, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0224.511] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf01a7230, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01a7230, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01cd390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0224.511] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sk\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0224.511] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sk\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0224.512] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136a8 [0224.512] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0224.512] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0224.550] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x136a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x136a8, lpOverlapped=0x0) returned 1 [0224.655] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x136b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x136b0, lpOverlapped=0x0) returned 1 [0224.657] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.714] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.726] CloseHandle (hObject=0xdc) returned 1 [0224.726] CloseHandle (hObject=0xf8) returned 1 [0224.726] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sk\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sk\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0224.727] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sk\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0224.727] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf01a7230, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01a7230, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01cd390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0224.727] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf01a7230, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01a7230, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01cd390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.727] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0224.727] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sk\\filesync.localizedresources.dll.mui")) returned 1 [0224.729] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sk\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0224.729] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf01a7230, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf01a7230, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf01cd390, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.729] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0224.729] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01cd390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf042e990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf042e990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sl", cAlternateFileName="")) returned 1 [0224.729] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01cd390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf042e990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf042e990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0224.729] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf01cd390, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf042e990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf042e990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0224.729] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf042e990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf042e990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf042e990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0224.730] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sl\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0224.730] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sl\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0224.731] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132b0 [0224.731] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0224.731] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0224.759] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x132b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x132b0, lpOverlapped=0x0) returned 1 [0224.854] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x132c0, lpOverlapped=0x0) returned 1 [0224.856] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0224.920] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0224.933] CloseHandle (hObject=0xf8) returned 1 [0224.933] CloseHandle (hObject=0xdc) returned 1 [0224.933] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sl\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sl\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0224.934] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sl\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0224.934] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf042e990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf042e990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf042e990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0224.934] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf042e990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf042e990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf042e990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.934] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0224.934] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sl\\filesync.localizedresources.dll.mui")) returned 1 [0224.935] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sl\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0224.936] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf042e990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf042e990, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf042e990, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0224.936] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0224.936] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf042e990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf05855f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf05855f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sq", cAlternateFileName="")) returned 1 [0224.936] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf042e990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf05855f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf05855f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0224.936] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf042e990, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf05855f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf05855f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0224.936] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf05855f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf05855f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf05855f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0224.937] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sq\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0224.937] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sq\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0224.937] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132b0 [0224.937] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0224.938] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0224.987] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x132b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x132b0, lpOverlapped=0x0) returned 1 [0225.065] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x132c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x132c0, lpOverlapped=0x0) returned 1 [0225.068] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.132] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.152] CloseHandle (hObject=0xdc) returned 1 [0225.153] CloseHandle (hObject=0xf8) returned 1 [0225.153] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sq\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sq\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0225.153] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sq\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0225.154] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf05855f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf05855f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf05855f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0225.154] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf05855f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf05855f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf05855f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0225.154] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0225.154] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sq\\filesync.localizedresources.dll.mui")) returned 1 [0225.155] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sq\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sq\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0225.155] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf05855f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf05855f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf05855f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0225.155] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0225.156] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe99cf270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe99cf270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe99cf270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2ff40, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0225.156] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sqmapi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0225.156] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sqmapi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmapi.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0225.157] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2ff40 [0225.157] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0225.157] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0225.190] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2ff40, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2ff40, lpOverlapped=0x0) returned 1 [0225.253] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2ff50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2ff50, lpOverlapped=0x0) returned 1 [0225.257] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.325] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.337] CloseHandle (hObject=0xe8) returned 1 [0225.337] CloseHandle (hObject=0xf8) returned 1 [0225.337] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sqmapi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmapi.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sqmapi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmapi.dll.ozq0")) returned 0 [0225.337] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sqmapi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmapi.dll.ozq0")) returned 0x2020 [0225.338] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sqmapi.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe99cf270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe99cf270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe99cf270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2ff40, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0x26dd88 [0225.338] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe99cf270, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe99cf270, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe99cf270, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2ff40, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0225.338] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0225.338] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sqmapi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmapi.dll")) returned 1 [0225.340] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sqmapi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmapi.dll")) returned 0xffffffff [0225.340] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9ad9c10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9ad9c10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9ad9c10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x98a8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="SqmWrapper.dll", cAlternateFileName="SQMWRA~1.DLL")) returned 1 [0225.340] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SqmWrapper.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmwrapper.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0225.341] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SqmWrapper.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmwrapper.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0225.341] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98a8 [0225.341] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0225.341] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0225.377] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x98a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x98a8, lpOverlapped=0x0) returned 1 [0225.484] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x98b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x98b0, lpOverlapped=0x0) returned 1 [0225.486] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.557] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.569] CloseHandle (hObject=0xf8) returned 1 [0225.569] CloseHandle (hObject=0xe8) returned 1 [0225.569] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SqmWrapper.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmwrapper.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SqmWrapper.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmwrapper.dll.ozq0")) returned 0 [0225.570] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SqmWrapper.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmwrapper.dll.ozq0")) returned 0x2020 [0225.570] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SqmWrapper.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9ad9c10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9ad9c10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9ad9c10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x98a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SqmWrapper.dll", cAlternateFileName="SQMWRA~1.DLL")) returned 0x26dd88 [0225.570] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9ad9c10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe9ad9c10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9ad9c10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x98a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SqmWrapper.dll", cAlternateFileName="SQMWRA~1.DLL")) returned 0 [0225.570] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0225.570] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SqmWrapper.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmwrapper.dll")) returned 1 [0225.572] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SqmWrapper.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sqmwrapper.dll")) returned 0xffffffff [0225.572] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf05855f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf068ff90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf068ff90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="sr-cyrl-ba", cAlternateFileName="SR-CYR~1")) returned 1 [0225.660] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf05855f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf068ff90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf068ff90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0225.697] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf05855f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf068ff90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf068ff90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0225.697] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf068ff90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf068ff90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf068ff90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0225.698] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-ba\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0225.698] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-ba\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0225.699] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130b0 [0225.699] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0225.699] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0225.771] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0225.782] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130c0, lpOverlapped=0x0) returned 1 [0225.791] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.844] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.856] CloseHandle (hObject=0xf8) returned 1 [0225.856] CloseHandle (hObject=0xdc) returned 1 [0225.856] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-ba\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-ba\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0225.857] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-ba\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0225.857] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf068ff90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf068ff90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf068ff90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0225.857] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf068ff90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf068ff90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf068ff90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0225.857] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0225.857] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-ba\\filesync.localizedresources.dll.mui")) returned 1 [0225.859] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-ba\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-ba\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0225.859] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf068ff90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf068ff90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf068ff90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0225.859] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0225.860] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf068ff90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf07c0a90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf07c0a90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sr-cyrl-rs", cAlternateFileName="SR-CYR~2")) returned 1 [0225.860] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf068ff90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf07c0a90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf07c0a90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0225.860] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf068ff90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf07c0a90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf07c0a90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0225.860] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf07c0a90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf07c0a90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf07c0a90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0225.861] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-rs\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0225.861] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-rs\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0225.862] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ca8 [0225.862] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0225.862] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0225.899] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ca8, lpOverlapped=0x0) returned 1 [0225.914] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0225.916] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0225.969] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0225.981] CloseHandle (hObject=0xdc) returned 1 [0225.981] CloseHandle (hObject=0xf8) returned 1 [0225.981] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-rs\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-rs\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0225.982] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-rs\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0225.982] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf07c0a90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf07c0a90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf07c0a90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0225.982] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf07c0a90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf07c0a90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf07c0a90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0225.982] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0225.982] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-rs\\filesync.localizedresources.dll.mui")) returned 1 [0225.983] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-cyrl-rs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-cyrl-rs\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0225.983] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf07c0a90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf07c0a90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf07c0a90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0225.984] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0225.984] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf07c0a90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf08cb430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf08cb430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sr-latn-rs", cAlternateFileName="SR-LAT~1")) returned 1 [0225.984] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf07c0a90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf08cb430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf08cb430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0225.993] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf07c0a90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf08cb430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf08cb430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0225.993] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf08cb430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf08cb430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf08cb430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0225.993] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-latn-rs\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0225.994] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-latn-rs\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0225.994] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ea8 [0225.994] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0225.995] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0226.030] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ea8, lpOverlapped=0x0) returned 1 [0226.134] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0226.136] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.191] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.202] CloseHandle (hObject=0xf8) returned 1 [0226.202] CloseHandle (hObject=0xdc) returned 1 [0226.203] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-latn-rs\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-latn-rs\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0226.203] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-latn-rs\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0226.203] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf08cb430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf08cb430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf08cb430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0226.203] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf08cb430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf08cb430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf08cb430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0226.203] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0226.203] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-latn-rs\\filesync.localizedresources.dll.mui")) returned 1 [0226.205] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sr-latn-rs\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sr-latn-rs\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0226.205] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf08cb430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf08cb430, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf08cb430, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0226.205] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0226.205] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf08cb430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf09fbf30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf09fbf30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sv", cAlternateFileName="")) returned 1 [0226.205] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf08cb430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf09fbf30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf09fbf30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0226.206] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf08cb430, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf09fbf30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf09fbf30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0226.206] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf09fbf30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf09fbf30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf09fbf30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0226.206] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sv\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0226.206] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sv\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0226.207] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122a8 [0226.207] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0226.207] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0226.238] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x122a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x122a8, lpOverlapped=0x0) returned 1 [0226.514] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x122b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x122b0, lpOverlapped=0x0) returned 1 [0226.520] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.589] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.606] CloseHandle (hObject=0xdc) returned 1 [0226.606] CloseHandle (hObject=0xf8) returned 1 [0226.609] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sv\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sv\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0226.610] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sv\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0226.610] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf09fbf30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf09fbf30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf09fbf30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0226.610] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf09fbf30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf09fbf30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf09fbf30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0226.610] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0226.611] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sv\\filesync.localizedresources.dll.mui")) returned 1 [0226.613] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sv\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sv\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0226.613] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf09fbf30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf09fbf30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf09fbf30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0226.613] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0226.613] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf09fbf30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0b2ca30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0b2ca30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="sw", cAlternateFileName="")) returned 1 [0226.613] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf09fbf30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0b2ca30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0b2ca30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0226.617] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf09fbf30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0b2ca30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0b2ca30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0226.617] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0b2ca30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0b2ca30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0b2ca30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0226.622] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sw\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0226.623] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sw\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0226.624] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122b0 [0226.624] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0226.625] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0226.660] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x122b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x122b0, lpOverlapped=0x0) returned 1 [0226.663] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x122c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x122c0, lpOverlapped=0x0) returned 1 [0226.665] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.729] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0226.742] CloseHandle (hObject=0xf8) returned 1 [0226.742] CloseHandle (hObject=0xdc) returned 1 [0226.742] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sw\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sw\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0226.743] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sw\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0226.743] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0b2ca30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0b2ca30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0b2ca30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0226.743] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0b2ca30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0b2ca30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0b2ca30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0226.744] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0226.744] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sw\\filesync.localizedresources.dll.mui")) returned 1 [0226.745] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\sw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\sw\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0226.745] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0b2ca30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0b2ca30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0b2ca30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0226.746] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0226.746] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea00ec30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea00ec30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea00ec30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2aaca0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="SyncEngine.dll", cAlternateFileName="SYNCEN~1.DLL")) returned 1 [0226.746] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SyncEngine.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\syncengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0226.746] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SyncEngine.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\syncengine.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0226.747] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2aaca0 [0226.747] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0226.748] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0226.786] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2aaca0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2aaca0, lpOverlapped=0x0) returned 1 [0226.889] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2aacb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2aacb0, lpOverlapped=0x0) returned 1 [0226.944] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0226.999] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.010] CloseHandle (hObject=0xe8) returned 1 [0227.010] CloseHandle (hObject=0xdc) returned 1 [0227.011] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SyncEngine.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\syncengine.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SyncEngine.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\syncengine.dll.ozq0")) returned 0 [0227.011] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SyncEngine.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\syncengine.dll.ozq0")) returned 0x2020 [0227.011] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SyncEngine.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea00ec30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea00ec30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea00ec30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2aaca0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SyncEngine.dll", cAlternateFileName="SYNCEN~1.DLL")) returned 0x26dd88 [0227.011] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea00ec30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea00ec30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea00ec30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2aaca0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SyncEngine.dll", cAlternateFileName="SYNCEN~1.DLL")) returned 0 [0227.012] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0227.012] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SyncEngine.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\syncengine.dll")) returned 1 [0227.018] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\SyncEngine.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\syncengine.dll")) returned 0xffffffff [0227.018] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0b2ca30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0c5d530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0c5d530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ta", cAlternateFileName="")) returned 1 [0227.018] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0b2ca30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0c5d530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0c5d530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0227.018] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0b2ca30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0c5d530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0c5d530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0227.019] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0c5d530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0c5d530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0c5d530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x142a8, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0227.019] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ta\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0227.106] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ta\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0227.107] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142a8 [0227.107] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0227.107] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0227.147] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x142a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x142a8, lpOverlapped=0x0) returned 1 [0227.268] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x142b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x142b0, lpOverlapped=0x0) returned 1 [0227.271] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.331] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.342] CloseHandle (hObject=0xe8) returned 1 [0227.342] CloseHandle (hObject=0xf8) returned 1 [0227.343] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ta\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ta\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0227.343] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ta\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0227.343] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0c5d530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0c5d530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0c5d530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x142a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0227.343] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0c5d530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0c5d530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0c5d530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x142a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0227.344] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0227.344] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ta\\filesync.localizedresources.dll.mui")) returned 1 [0227.345] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ta\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ta\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0227.345] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0c5d530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0c5d530, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0c5d530, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x142a8, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0227.345] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0227.345] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0c5d530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0d67ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0d67ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="te", cAlternateFileName="")) returned 1 [0227.345] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0c5d530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0d67ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0d67ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0227.346] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0c5d530, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0d67ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0d67ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0227.346] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0d67ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0d67ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0d67ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0227.346] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\te\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0227.346] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\te\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0227.347] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ea8 [0227.347] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0227.347] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0227.382] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ea8, lpOverlapped=0x0) returned 1 [0227.424] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12eb0, lpOverlapped=0x0) returned 1 [0227.429] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0227.486] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0227.498] CloseHandle (hObject=0xf8) returned 1 [0227.498] CloseHandle (hObject=0xe8) returned 1 [0227.498] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\te\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\te\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0227.499] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\te\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0227.499] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0d67ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0d67ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0d67ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0227.499] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0d67ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0d67ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0d67ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0227.499] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0227.499] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\te\\filesync.localizedresources.dll.mui")) returned 1 [0227.501] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\te\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\te\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0227.501] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0d67ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0d67ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0d67ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0227.501] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0227.501] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea1d7cb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea1d7cb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea1d7cb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x754a8, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="Telemetry.dll", cAlternateFileName="TELEME~1.DLL")) returned 1 [0227.501] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\Telemetry.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\telemetry.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0227.502] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\Telemetry.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\telemetry.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0227.502] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x754a8 [0227.502] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0227.503] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0227.540] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x754a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x754a8, lpOverlapped=0x0) returned 1 [0228.169] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x754b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x754b0, lpOverlapped=0x0) returned 1 [0228.178] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.242] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.253] CloseHandle (hObject=0xdc) returned 1 [0228.253] CloseHandle (hObject=0xe8) returned 1 [0228.254] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\Telemetry.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\telemetry.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\Telemetry.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\telemetry.dll.ozq0")) returned 0 [0228.254] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\Telemetry.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\telemetry.dll.ozq0")) returned 0x2020 [0228.254] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\Telemetry.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea1d7cb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea1d7cb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea1d7cb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x754a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Telemetry.dll", cAlternateFileName="TELEME~1.DLL")) returned 0x26dd88 [0228.254] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea1d7cb0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea1d7cb0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea1d7cb0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x754a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Telemetry.dll", cAlternateFileName="TELEME~1.DLL")) returned 0 [0228.255] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0228.255] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\Telemetry.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\telemetry.dll")) returned 1 [0228.259] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\Telemetry.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\telemetry.dll")) returned 0xffffffff [0228.259] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0d67ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0ebeb30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0ebeb30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="tg", cAlternateFileName="")) returned 1 [0228.259] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0d67ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0ebeb30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0ebeb30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa200a0, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0228.259] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0d67ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0ebeb30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0ebeb30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa200a0, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0228.260] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0ebeb30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0ebeb30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0ebeb30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0xa200a0, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0228.260] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0228.262] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0228.263] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ca8 [0228.263] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0228.263] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0228.301] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13ca8, lpOverlapped=0x0) returned 1 [0228.312] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13cb0, lpOverlapped=0x0) returned 1 [0228.314] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.369] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.381] CloseHandle (hObject=0xdc) returned 1 [0228.381] CloseHandle (hObject=0xf8) returned 1 [0228.382] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0228.382] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0228.382] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0ebeb30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0ebeb30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0ebeb30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0228.383] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0ebeb30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0ebeb30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0ebeb30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0228.383] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0228.383] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg\\filesync.localizedresources.dll.mui")) returned 1 [0228.384] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0228.384] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0ebeb30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0ebeb30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0ebeb30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0xa200a0, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0228.384] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0228.385] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0ebeb30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0fef630, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0fef630, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="tg-cyrl", cAlternateFileName="")) returned 1 [0228.385] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0ebeb30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0fef630, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0fef630, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0228.431] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0ebeb30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0fef630, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0fef630, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0228.431] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0fef630, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0fef630, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0fef630, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0228.431] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg-cyrl\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0228.431] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg-cyrl\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0228.432] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13ca8 [0228.432] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0228.433] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0228.470] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13ca8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x13ca8, lpOverlapped=0x0) returned 1 [0228.547] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13cb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x13cb0, lpOverlapped=0x0) returned 1 [0228.550] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.624] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.648] CloseHandle (hObject=0xf8) returned 1 [0228.648] CloseHandle (hObject=0xdc) returned 1 [0228.648] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg-cyrl\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg-cyrl\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0228.649] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg-cyrl\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0228.650] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0fef630, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0fef630, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0fef630, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0228.650] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0fef630, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0fef630, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0fef630, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0228.650] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0228.650] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg-cyrl\\filesync.localizedresources.dll.mui")) returned 1 [0228.652] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tg-cyrl\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tg-cyrl\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0228.652] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf0fef630, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf0fef630, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf0fef630, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x13ca8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0228.652] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0228.652] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0fef630, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1146290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1146290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="th", cAlternateFileName="")) returned 1 [0228.652] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0fef630, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1146290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1146290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0228.652] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf0fef630, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1146290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1146290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0228.652] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1146290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1146290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1146290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0228.653] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\th\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0228.653] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\th\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0228.654] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x118b0 [0228.654] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0228.654] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0228.696] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x118b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x118b0, lpOverlapped=0x0) returned 1 [0228.720] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x118c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x118c0, lpOverlapped=0x0) returned 1 [0228.722] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0228.783] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0228.795] CloseHandle (hObject=0xdc) returned 1 [0228.795] CloseHandle (hObject=0xf8) returned 1 [0228.795] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\th\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\th\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0228.796] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\th\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0228.796] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1146290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1146290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1146290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0228.796] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1146290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1146290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1146290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0228.796] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0228.796] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\th\\filesync.localizedresources.dll.mui")) returned 1 [0228.798] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\th\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\th\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0228.798] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1146290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1146290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1146290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x118b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0228.798] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0228.798] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1146290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1276d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1276d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ti", cAlternateFileName="")) returned 1 [0228.798] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1146290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1276d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1276d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0228.857] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1146290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1276d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1276d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0228.857] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1276d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1276d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1276d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0228.858] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ti\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0228.858] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ti\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0228.859] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf6b0 [0228.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0228.859] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0228.902] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf6b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xf6b0, lpOverlapped=0x0) returned 1 [0228.964] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf6c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xf6c0, lpOverlapped=0x0) returned 1 [0228.966] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.026] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.038] CloseHandle (hObject=0xf8) returned 1 [0229.039] CloseHandle (hObject=0xdc) returned 1 [0229.039] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ti\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ti\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0229.039] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ti\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0229.039] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1276d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1276d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1276d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0229.040] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1276d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1276d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1276d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0229.040] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0229.040] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ti\\filesync.localizedresources.dll.mui")) returned 1 [0229.041] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ti\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ti\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0229.041] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1276d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1276d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1276d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xf6b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0229.042] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0229.042] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1276d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf13a7890, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf13a7890, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="tk-tm", cAlternateFileName="")) returned 1 [0229.042] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1276d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf13a7890, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf13a7890, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0229.042] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1276d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf13a7890, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf13a7890, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0229.042] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf13a7890, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf13a7890, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf13a7890, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0229.043] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tk-tm\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0229.043] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tk-tm\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0229.044] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126b0 [0229.044] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0229.044] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0229.096] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0229.568] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126c0, lpOverlapped=0x0) returned 1 [0229.571] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.630] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.642] CloseHandle (hObject=0xdc) returned 1 [0229.642] CloseHandle (hObject=0xf8) returned 1 [0229.643] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tk-tm\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tk-tm\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0229.644] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tk-tm\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0229.644] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf13a7890, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf13a7890, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf13a7890, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0229.644] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf13a7890, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf13a7890, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf13a7890, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0229.644] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0229.644] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tk-tm\\filesync.localizedresources.dll.mui")) returned 1 [0229.646] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tk-tm\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tk-tm\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0229.646] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf13a7890, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf13a7890, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf13a7890, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0229.646] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0229.646] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf13a7890, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf14fe4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf14fe4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="tn-za", cAlternateFileName="")) returned 1 [0229.646] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf13a7890, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf14fe4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf14fe4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0229.679] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf13a7890, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf14fe4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf14fe4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0229.679] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf14fe4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf14fe4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf14fe4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x144b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0229.680] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tn-za\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0229.680] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tn-za\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0229.681] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144b0 [0229.681] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0229.681] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0229.735] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x144b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x144b0, lpOverlapped=0x0) returned 1 [0229.828] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x144c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x144c0, lpOverlapped=0x0) returned 1 [0229.830] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0229.895] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0229.911] CloseHandle (hObject=0xf8) returned 1 [0229.911] CloseHandle (hObject=0xdc) returned 1 [0229.911] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tn-za\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tn-za\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0229.912] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tn-za\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0229.912] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf14fe4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf14fe4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf14fe4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x144b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0229.912] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf14fe4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf14fe4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf14fe4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x144b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0229.913] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0229.913] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tn-za\\filesync.localizedresources.dll.mui")) returned 1 [0229.914] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tn-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tn-za\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0229.914] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf14fe4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf14fe4f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf14fe4f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x144b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0229.914] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0229.915] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf14fe4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1655150, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1655150, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="tr", cAlternateFileName="")) returned 1 [0229.915] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf14fe4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1655150, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1655150, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0229.915] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf14fe4f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1655150, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1655150, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0229.915] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1655150, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1655150, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1655150, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128a0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0229.915] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tr\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0229.916] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tr\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0229.916] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x128a0 [0229.916] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0229.917] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0229.969] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x128a0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x128a0, lpOverlapped=0x0) returned 1 [0230.081] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x128b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x128b0, lpOverlapped=0x0) returned 1 [0230.083] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.163] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.180] CloseHandle (hObject=0xdc) returned 1 [0230.180] CloseHandle (hObject=0xf8) returned 1 [0230.181] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tr\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tr\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0230.181] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tr\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0230.181] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1655150, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1655150, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1655150, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128a0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0230.182] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1655150, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1655150, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1655150, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128a0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0230.182] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0230.182] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tr\\filesync.localizedresources.dll.mui")) returned 1 [0230.183] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tr\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tr\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0230.183] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1655150, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1655150, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1655150, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128a0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0230.183] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0230.183] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1655150, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf17f8070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf17f8070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="tt", cAlternateFileName="")) returned 1 [0230.183] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1655150, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf17f8070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf17f8070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0230.185] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1655150, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf17f8070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf17f8070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0230.185] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf17f8070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf17f8070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf17f8070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0230.185] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tt\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0230.185] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tt\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0230.186] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x126b0 [0230.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0230.186] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0230.238] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x126b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x126b0, lpOverlapped=0x0) returned 1 [0230.249] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x126c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x126c0, lpOverlapped=0x0) returned 1 [0230.251] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.313] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.325] CloseHandle (hObject=0xf8) returned 1 [0230.325] CloseHandle (hObject=0xdc) returned 1 [0230.325] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tt\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tt\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0230.326] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tt\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0230.326] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf17f8070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf17f8070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf17f8070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0230.326] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf17f8070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf17f8070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf17f8070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0230.326] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0230.326] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tt\\filesync.localizedresources.dll.mui")) returned 1 [0230.329] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\tt\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\tt\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0230.329] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf17f8070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf17f8070, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf17f8070, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x126b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0230.329] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0230.329] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf17f8070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1928b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1928b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ug", cAlternateFileName="")) returned 1 [0230.329] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf17f8070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1928b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1928b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0230.330] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf17f8070, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1928b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1928b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0230.330] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1928b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1928b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1928b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0230.330] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0230.330] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0230.331] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x128b0 [0230.331] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0230.331] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0230.377] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x128b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x128b0, lpOverlapped=0x0) returned 1 [0230.406] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x128c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x128c0, lpOverlapped=0x0) returned 1 [0230.408] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0230.481] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0230.493] CloseHandle (hObject=0xdc) returned 1 [0230.493] CloseHandle (hObject=0xf8) returned 1 [0230.493] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0230.494] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0230.494] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1928b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1928b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1928b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0230.494] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1928b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1928b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1928b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0230.494] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0230.494] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug\\filesync.localizedresources.dll.mui")) returned 1 [0230.496] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0230.496] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1928b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1928b70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1928b70, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0230.496] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0230.496] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1928b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1a59670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1a59670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ug-arab", cAlternateFileName="")) returned 1 [0230.496] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1928b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1a59670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1a59670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0230.919] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1928b70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1a59670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1a59670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0230.919] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1a59670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1a59670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1a59670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0230.919] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug-arab\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0230.920] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug-arab\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0230.921] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x128b0 [0230.921] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0230.921] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0230.961] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x128b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x128b0, lpOverlapped=0x0) returned 1 [0230.965] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x128c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x128c0, lpOverlapped=0x0) returned 1 [0230.968] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.028] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.040] CloseHandle (hObject=0xf8) returned 1 [0231.040] CloseHandle (hObject=0xdc) returned 1 [0231.041] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug-arab\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug-arab\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0231.041] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug-arab\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0231.041] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1a59670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1a59670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1a59670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0231.042] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1a59670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1a59670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1a59670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.042] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0231.042] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug-arab\\filesync.localizedresources.dll.mui")) returned 1 [0231.043] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ug-arab\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ug-arab\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0231.043] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1a59670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1a59670, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1a59670, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x128b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.043] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0231.043] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1a59670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1b8a170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1b8a170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="uk", cAlternateFileName="")) returned 1 [0231.043] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1a59670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1b8a170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1b8a170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0231.044] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1a59670, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1b8a170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1b8a170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0231.044] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1b8a170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1b8a170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1b8a170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0231.045] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uk\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0231.045] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uk\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0231.045] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x130b0 [0231.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0231.046] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0231.089] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x130b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x130b0, lpOverlapped=0x0) returned 1 [0231.138] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x130c0, lpOverlapped=0x0) returned 1 [0231.140] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.213] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.225] CloseHandle (hObject=0xdc) returned 1 [0231.225] CloseHandle (hObject=0xf8) returned 1 [0231.226] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uk\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uk\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0231.226] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uk\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0231.226] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1b8a170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1b8a170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1b8a170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0231.227] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1b8a170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1b8a170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1b8a170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.227] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0231.227] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uk\\filesync.localizedresources.dll.mui")) returned 1 [0231.228] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uk\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uk\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0231.228] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1b8a170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1b8a170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1b8a170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x130b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.228] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0231.228] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1b8a170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1ce0dd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1ce0dd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="ur", cAlternateFileName="")) returned 1 [0231.228] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1b8a170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1ce0dd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1ce0dd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0231.317] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1b8a170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1ce0dd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1ce0dd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0231.317] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1ce0dd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1ce0dd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1ce0dd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0231.318] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ur\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0231.318] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ur\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0231.319] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12cb0 [0231.319] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0231.319] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0231.367] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12cb0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12cb0, lpOverlapped=0x0) returned 1 [0231.592] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12cc0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12cc0, lpOverlapped=0x0) returned 1 [0231.594] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.659] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.671] CloseHandle (hObject=0xf8) returned 1 [0231.671] CloseHandle (hObject=0xdc) returned 1 [0231.671] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ur\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ur\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0231.671] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ur\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0231.672] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1ce0dd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1ce0dd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1ce0dd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0231.672] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1ce0dd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1ce0dd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1ce0dd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.672] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0231.672] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ur\\filesync.localizedresources.dll.mui")) returned 1 [0231.673] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\ur\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\ur\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0231.673] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1ce0dd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1ce0dd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1ce0dd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12cb0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.673] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0231.673] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1ce0dd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1e118d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1e118d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="uz-latn-uz", cAlternateFileName="UZ-LAT~1")) returned 1 [0231.673] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1ce0dd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1e118d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1e118d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0231.674] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1ce0dd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1e118d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1e118d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0231.674] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1e118d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1e118d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1e118d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0231.674] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uz-latn-uz\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0231.675] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uz-latn-uz\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0231.675] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x136b0 [0231.675] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0231.675] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0231.715] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x136b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x136b0, lpOverlapped=0x0) returned 1 [0231.720] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x136c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x136c0, lpOverlapped=0x0) returned 1 [0231.722] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.784] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.803] CloseHandle (hObject=0xdc) returned 1 [0231.803] CloseHandle (hObject=0xf8) returned 1 [0231.803] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uz-latn-uz\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uz-latn-uz\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0231.804] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uz-latn-uz\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0231.804] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1e118d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1e118d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1e118d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f28 [0231.804] FindNextFileA (in: hFindFile=0x277f28, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1e118d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1e118d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1e118d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.804] FindClose (in: hFindFile=0x277f28 | out: hFindFile=0x277f28) returned 1 [0231.804] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uz-latn-uz\\filesync.localizedresources.dll.mui")) returned 1 [0231.806] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\uz-latn-uz\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\uz-latn-uz\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0231.806] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1e118d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1e118d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1e118d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x136b0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.806] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0231.806] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1e118d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1f423d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1f423d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="vi", cAlternateFileName="")) returned 1 [0231.806] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1e118d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1f423d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1f423d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0231.806] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1e118d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1f423d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1f423d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0231.806] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1f423d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1f423d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1f423d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0231.807] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\vi\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0231.807] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\vi\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0231.807] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x132a8 [0231.807] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0231.808] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0231.863] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x132a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x132a8, lpOverlapped=0x0) returned 1 [0231.865] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x132b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x132b0, lpOverlapped=0x0) returned 1 [0231.867] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0231.929] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0231.942] CloseHandle (hObject=0xf8) returned 1 [0231.942] CloseHandle (hObject=0xdc) returned 1 [0231.942] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\vi\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\vi\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0231.943] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\vi\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0231.943] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1f423d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1f423d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1f423d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0231.943] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1f423d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1f423d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1f423d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.943] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0231.943] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\vi\\filesync.localizedresources.dll.mui")) returned 1 [0231.944] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\vi\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\vi\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0231.944] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1f423d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf1f423d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf1f423d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x132a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0231.944] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0231.944] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea3087b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea3087b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea3087b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x652a0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="VideoStreamingPlugin.dll", cAlternateFileName="VIDEOS~1.DLL")) returned 1 [0231.945] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\VideoStreamingPlugin.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\videostreamingplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0231.945] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\VideoStreamingPlugin.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\videostreamingplugin.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0231.946] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x652a0 [0231.946] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0231.946] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0231.991] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x652a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x652a0, lpOverlapped=0x0) returned 1 [0232.059] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x652b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x652b0, lpOverlapped=0x0) returned 1 [0232.066] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.131] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.143] CloseHandle (hObject=0xe8) returned 1 [0232.143] CloseHandle (hObject=0xdc) returned 1 [0232.143] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\VideoStreamingPlugin.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\videostreamingplugin.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\VideoStreamingPlugin.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\videostreamingplugin.dll.ozq0")) returned 0 [0232.144] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\VideoStreamingPlugin.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\videostreamingplugin.dll.ozq0")) returned 0x2020 [0232.144] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\VideoStreamingPlugin.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea3087b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea3087b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea3087b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x652a0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="VideoStreamingPlugin.dll", cAlternateFileName="VIDEOS~1.DLL")) returned 0x26dd88 [0232.144] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea3087b0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea3087b0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea3087b0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x652a0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="VideoStreamingPlugin.dll", cAlternateFileName="VIDEOS~1.DLL")) returned 0 [0232.144] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0232.144] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\VideoStreamingPlugin.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\videostreamingplugin.dll")) returned 1 [0232.148] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\VideoStreamingPlugin.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\videostreamingplugin.dll")) returned 0xffffffff [0232.148] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea4ab6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea4ab6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea4ab6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x684a0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="wlmfds.dll", cAlternateFileName="")) returned 1 [0232.149] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wlmfds.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wlmfds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0232.149] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wlmfds.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wlmfds.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.149] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x684a0 [0232.149] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0232.150] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0232.196] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x684a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x684a0, lpOverlapped=0x0) returned 1 [0232.309] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x684b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x684b0, lpOverlapped=0x0) returned 1 [0232.317] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.376] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.387] CloseHandle (hObject=0xdc) returned 1 [0232.388] CloseHandle (hObject=0xe8) returned 1 [0232.388] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wlmfds.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wlmfds.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wlmfds.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wlmfds.dll.ozq0")) returned 0 [0232.388] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wlmfds.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wlmfds.dll.ozq0")) returned 0x2020 [0232.389] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wlmfds.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea4ab6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea4ab6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea4ab6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x684a0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="wlmfds.dll", cAlternateFileName="")) returned 0x26dd88 [0232.389] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea4ab6d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea4ab6d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea4ab6d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x684a0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="wlmfds.dll", cAlternateFileName="")) returned 0 [0232.389] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0232.389] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wlmfds.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wlmfds.dll")) returned 1 [0232.393] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wlmfds.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wlmfds.dll")) returned 0xffffffff [0232.393] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea5dc1d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea5dc1d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea64e5f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x60ca8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WnsClientApi.dll", cAlternateFileName="WNSCLI~1.DLL")) returned 1 [0232.393] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\WnsClientApi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wnsclientapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.394] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\WnsClientApi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wnsclientapi.dll.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0232.394] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60ca8 [0232.394] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0232.395] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0232.442] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x60ca8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x60ca8, lpOverlapped=0x0) returned 1 [0232.480] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x60cb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x60cb0, lpOverlapped=0x0) returned 1 [0232.487] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.547] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.560] CloseHandle (hObject=0xe8) returned 1 [0232.560] CloseHandle (hObject=0xdc) returned 1 [0232.560] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\WnsClientApi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wnsclientapi.dll"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\WnsClientApi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wnsclientapi.dll.ozq0")) returned 0 [0232.560] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\WnsClientApi.dll.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wnsclientapi.dll.ozq0")) returned 0x2020 [0232.561] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\WnsClientApi.dll", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea5dc1d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea5dc1d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea64e5f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x60ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WnsClientApi.dll", cAlternateFileName="WNSCLI~1.DLL")) returned 0x26dd88 [0232.561] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xea5dc1d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xea5dc1d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xea64e5f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x60ca8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WnsClientApi.dll", cAlternateFileName="WNSCLI~1.DLL")) returned 0 [0232.561] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0232.561] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\WnsClientApi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wnsclientapi.dll")) returned 1 [0232.565] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\WnsClientApi.dll" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wnsclientapi.dll")) returned 0xffffffff [0232.565] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1f423d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2072ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2072ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="wo", cAlternateFileName="")) returned 1 [0232.565] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1f423d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2072ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2072ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0232.570] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf1f423d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2072ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2072ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa800a6, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0232.570] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2072ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2072ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2072ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116b0, dwReserved0=0xa800a6, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0232.570] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wo\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.570] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wo\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0232.571] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x116b0 [0232.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0232.572] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0232.618] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x116b0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x116b0, lpOverlapped=0x0) returned 1 [0232.620] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x116c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x116c0, lpOverlapped=0x0) returned 1 [0232.622] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.679] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.690] CloseHandle (hObject=0xe8) returned 1 [0232.691] CloseHandle (hObject=0xf8) returned 1 [0232.693] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wo\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wo\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0232.693] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wo\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0232.694] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2072ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2072ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2072ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f18 [0232.694] FindNextFileA (in: hFindFile=0x277f18, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2072ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2072ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2072ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116b0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0232.694] FindClose (in: hFindFile=0x277f18 | out: hFindFile=0x277f18) returned 1 [0232.694] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wo\\filesync.localizedresources.dll.mui")) returned 1 [0232.695] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\wo\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\wo\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0232.695] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2072ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2072ed0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2072ed0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x116b0, dwReserved0=0xa800a6, dwReserved1=0x276e30, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0232.695] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0232.695] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2072ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf21a39d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf21a39d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="xh-za", cAlternateFileName="")) returned 1 [0232.695] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2072ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf21a39d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf21a39d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0232.696] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2072ed0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf21a39d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf21a39d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0232.696] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21a39d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf21a39d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf21c9b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ab0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0232.696] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\xh-za\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0232.696] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\xh-za\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.697] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ab0 [0232.697] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0232.697] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0232.740] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ab0, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x12ab0, lpOverlapped=0x0) returned 1 [0232.742] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12ac0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x12ac0, lpOverlapped=0x0) returned 1 [0232.744] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.809] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.821] CloseHandle (hObject=0xf8) returned 1 [0232.821] CloseHandle (hObject=0xe8) returned 1 [0232.821] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\xh-za\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\xh-za\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0232.822] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\xh-za\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0232.822] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21a39d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf21a39d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf21c9b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ab0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0232.822] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21a39d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf21a39d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf21c9b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ab0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0232.822] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0232.822] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\xh-za\\filesync.localizedresources.dll.mui")) returned 1 [0232.824] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\xh-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\xh-za\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0232.824] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf21a39d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf21a39d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf21c9b30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x12ab0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0232.824] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0232.824] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf21c9b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2320790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2320790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="yo-ng", cAlternateFileName="")) returned 1 [0232.824] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf21c9b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2320790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2320790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0232.826] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf21c9b30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2320790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2320790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0232.826] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2320790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2320790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2320790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0232.826] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\yo-ng\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.826] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\yo-ng\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0232.827] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122a8 [0232.827] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0232.827] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0232.874] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x122a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x122a8, lpOverlapped=0x0) returned 1 [0232.879] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x122b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x122b0, lpOverlapped=0x0) returned 1 [0232.881] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0232.946] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0232.957] CloseHandle (hObject=0xe8) returned 1 [0232.957] CloseHandle (hObject=0xf8) returned 1 [0232.958] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\yo-ng\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\yo-ng\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0232.958] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\yo-ng\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0232.958] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2320790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2320790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2320790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0232.959] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2320790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2320790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2320790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122a8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0232.959] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0232.959] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\yo-ng\\filesync.localizedresources.dll.mui")) returned 1 [0232.960] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\yo-ng\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\yo-ng\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0232.960] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2320790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2320790, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2320790, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x122a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0232.960] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0232.960] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2320790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2451290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2451290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0232.960] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2320790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2451290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2451290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0232.961] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2320790, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2451290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2451290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0232.961] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2451290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2451290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2451290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xbea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0232.961] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-cn\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0232.961] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-cn\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0232.962] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbea8 [0232.962] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0232.962] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0233.007] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xbea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xbea8, lpOverlapped=0x0) returned 1 [0233.009] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xbeb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xbeb0, lpOverlapped=0x0) returned 1 [0233.011] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.071] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.083] CloseHandle (hObject=0xf8) returned 1 [0233.083] CloseHandle (hObject=0xe8) returned 1 [0233.083] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-cn\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-cn\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0233.084] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-cn\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0233.084] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2451290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2451290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2451290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xbea8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0233.084] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2451290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2451290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2451290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xbea8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0233.084] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0233.084] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-cn\\filesync.localizedresources.dll.mui")) returned 1 [0233.085] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-cn\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-cn\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0233.085] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2451290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2451290, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2451290, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xbea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0233.085] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0233.085] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2451290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2581d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2581d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0233.085] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2451290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2581d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2581d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0233.087] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2451290, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2581d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2581d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0233.087] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2581d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2581d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2581d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xbea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0233.088] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-tw\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0233.088] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-tw\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0233.089] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xbea8 [0233.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0233.089] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0233.132] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xbea8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xbea8, lpOverlapped=0x0) returned 1 [0233.161] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xbeb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xbeb0, lpOverlapped=0x0) returned 1 [0233.163] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.222] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.236] CloseHandle (hObject=0xe8) returned 1 [0233.236] CloseHandle (hObject=0xf8) returned 1 [0233.236] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-tw\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-tw\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0233.237] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-tw\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0233.237] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2581d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2581d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2581d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xbea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0233.237] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2581d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2581d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2581d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xbea8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0233.237] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0233.237] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-tw\\filesync.localizedresources.dll.mui")) returned 1 [0233.239] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zh-tw\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zh-tw\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0233.239] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2581d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2581d90, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2581d90, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0xbea8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0233.239] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0233.239] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2581d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26d89f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26d89f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="zu-za", cAlternateFileName="")) returned 1 [0233.239] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2581d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26d89f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26d89f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0233.239] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2581d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26d89f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26d89f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0233.239] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26d89f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26d89f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x134a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 1 [0233.240] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zu-za\\filesync.localizedresources.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0233.240] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zu-za\\filesync.localizedresources.dll.mui.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0233.241] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x134a8 [0233.241] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0233.241] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0233.284] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x134a8, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x134a8, lpOverlapped=0x0) returned 1 [0233.286] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x134b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x134b0, lpOverlapped=0x0) returned 1 [0233.288] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.364] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.375] CloseHandle (hObject=0xf8) returned 1 [0233.376] CloseHandle (hObject=0xe8) returned 1 [0233.376] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zu-za\\filesync.localizedresources.dll.mui"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zu-za\\filesync.localizedresources.dll.mui.ozq0")) returned 0 [0233.376] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\FileSync.LocalizedResources.dll.mui.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zu-za\\filesync.localizedresources.dll.mui.ozq0")) returned 0x2020 [0233.376] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\FileSync.LocalizedResources.dll.mui", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26d89f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26d89f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x134a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0x277f20 [0233.377] FindNextFileA (in: hFindFile=0x277f20, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26d89f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26d89f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x134a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0233.377] FindClose (in: hFindFile=0x277f20 | out: hFindFile=0x277f20) returned 1 [0233.377] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zu-za\\filesync.localizedresources.dll.mui")) returned 1 [0233.378] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\17.3.4604.0120\\zu-za\\FileSync.LocalizedResources.dll.mui" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\17.3.4604.0120\\zu-za\\filesync.localizedresources.dll.mui")) returned 0xffffffff [0233.378] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26d89f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26d89f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26feb50, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x134a8, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="FileSync.LocalizedResources.dll.mui", cAlternateFileName="FILESY~1.MUI")) returned 0 [0233.378] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0233.378] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf2581d90, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26d89f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf26d89f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x696c6163, dwReserved1=0x5264657a, cFileName="zu-za", cAlternateFileName="")) returned 0 [0233.379] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0233.379] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26feb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9617010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x44aa8, dwReserved0=0x6c642e69, dwReserved1=0x6967756c, cFileName="OneDrive.exe", cAlternateFileName="")) returned 1 [0233.379] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\onedrive.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0233.379] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\onedrive.exe.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0233.380] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x44aa8 [0233.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0233.380] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0233.425] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x44aa8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x44aa8, lpOverlapped=0x0) returned 1 [0233.481] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x44ab0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x44ab0, lpOverlapped=0x0) returned 1 [0233.487] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.542] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.553] CloseHandle (hObject=0xe0) returned 1 [0233.554] CloseHandle (hObject=0xdc) returned 1 [0233.554] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\onedrive.exe"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\onedrive.exe.ozq0")) returned 0 [0233.554] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\onedrive.exe.ozq0")) returned 0x2020 [0233.555] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26feb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9617010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x44aa8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="OneDrive.exe", cAlternateFileName="")) returned 0x26dd48 [0233.555] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf26feb50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf26feb50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe9617010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x44aa8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="OneDrive.exe", cAlternateFileName="")) returned 0 [0233.555] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0233.555] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\onedrive.exe")) returned 1 [0233.560] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\onedrive.exe")) returned 0xffffffff [0233.560] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="setup", cAlternateFileName="")) returned 1 [0233.560] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x820080, dwReserved1=0x275e28, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0233.561] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x820080, dwReserved1=0x275e28, cFileName="..", cAlternateFileName="")) returned 1 [0233.561] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe906fbd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe906fbd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x820080, dwReserved1=0x275e28, cFileName="logs", cAlternateFileName="")) returned 1 [0233.561] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe906fbd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe906fbd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0233.631] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe906fbd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe906fbd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName="..", cAlternateFileName="")) returned 1 [0233.631] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe906fbd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe906fbd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3e5a330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x3b26, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName="2021-02-22_125735_378-458.log", cAlternateFileName="2021-0~3.LOG")) returned 1 [0233.631] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_378-458.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_378-458.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0233.632] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_378-458.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_378-458.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0233.632] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b26 [0233.632] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0233.633] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0233.676] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3b26, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x3b26, lpOverlapped=0x0) returned 1 [0233.793] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x3b30, lpOverlapped=0x0) returned 1 [0233.794] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0233.853] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0233.865] CloseHandle (hObject=0xe8) returned 1 [0233.865] CloseHandle (hObject=0xf8) returned 1 [0233.865] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_378-458.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_378-458.log"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_378-458.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_378-458.log.ozq0")) returned 0 [0233.866] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_378-458.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_378-458.log.ozq0")) returned 0x2020 [0233.866] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_378-458.log", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe906fbd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe906fbd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3e5a330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x3b26, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2021-02-22_125735_378-458.log", cAlternateFileName="2021-0~3.LOG")) returned 0x277f00 [0233.866] FindNextFileA (in: hFindFile=0x277f00, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe906fbd0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe906fbd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3e5a330, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x3b26, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2021-02-22_125735_378-458.log", cAlternateFileName="2021-0~3.LOG")) returned 0 [0233.866] FindClose (in: hFindFile=0x277f00 | out: hFindFile=0x277f00) returned 1 [0233.866] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_378-458.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_378-458.log")) returned 1 [0233.867] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_378-458.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_378-458.log")) returned 0xffffffff [0233.867] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8de8470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8de8470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf417a010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x448a, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="2021-02-22_125735_3c4-a98.log", cAlternateFileName="2021-0~2.LOG")) returned 1 [0233.868] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0233.869] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0233.869] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x448a [0233.870] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0233.870] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0233.910] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x448a, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x448a, lpOverlapped=0x0) returned 1 [0234.068] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4490, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4490, lpOverlapped=0x0) returned 1 [0234.078] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.142] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.155] CloseHandle (hObject=0xf8) returned 1 [0234.155] CloseHandle (hObject=0xe8) returned 1 [0234.155] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log.ozq0")) returned 0 [0234.156] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log.ozq0")) returned 0x2020 [0234.156] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8de8470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8de8470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf417a010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x448a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="2021-02-22_125735_3c4-a98.log", cAlternateFileName="2021-0~2.LOG")) returned 0x277f00 [0234.156] FindNextFileA (in: hFindFile=0x277f00, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8de8470, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8de8470, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf417a010, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x448a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="2021-02-22_125735_3c4-a98.log", cAlternateFileName="2021-0~2.LOG")) returned 0 [0234.156] FindClose (in: hFindFile=0x277f00 | out: hFindFile=0x277f00) returned 1 [0234.156] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log")) returned 1 [0234.157] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_3c4-a98.log")) returned 0xffffffff [0234.157] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf52e20f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1f4a, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="2021-02-22_125735_4d4-a74.log", cAlternateFileName="2021-0~1.LOG")) returned 1 [0234.158] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0234.158] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0234.159] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f4a [0234.159] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0234.159] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0234.209] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1f4a, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x1f4a, lpOverlapped=0x0) returned 1 [0234.305] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x1f50, lpOverlapped=0x0) returned 1 [0234.307] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.374] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.389] CloseHandle (hObject=0xe8) returned 1 [0234.389] CloseHandle (hObject=0xf8) returned 1 [0234.389] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log.ozq0")) returned 0 [0234.390] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log.ozq0")) returned 0x2020 [0234.390] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf52e20f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1f4a, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2021-02-22_125735_4d4-a74.log", cAlternateFileName="2021-0~1.LOG")) returned 0x277f00 [0234.390] FindNextFileA (in: hFindFile=0x277f00, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf52e20f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1f4a, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2021-02-22_125735_4d4-a74.log", cAlternateFileName="2021-0~1.LOG")) returned 0 [0234.390] FindClose (in: hFindFile=0x277f00 | out: hFindFile=0x277f00) returned 1 [0234.390] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log")) returned 1 [0234.391] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\OneDrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\onedrive\\setup\\logs\\2021-02-22_125735_4d4-a74.log")) returned 0xffffffff [0234.391] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf52e20f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x1f4a, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="2021-02-22_125735_4d4-a74.log", cAlternateFileName="2021-0~1.LOG")) returned 0 [0234.392] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0234.392] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe906fbd0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe906fbd0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x820080, dwReserved1=0x275e28, cFileName="logs", cAlternateFileName="")) returned 0 [0234.392] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0234.392] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8a7c4d0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8a7c4d0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8a7c4d0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="setup", cAlternateFileName="")) returned 0 [0234.392] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0234.392] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ce8e9d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x23884f50, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x23884f50, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65303265, dwReserved1=0x61432073, cFileName="Outlook", cAlternateFileName="")) returned 1 [0234.392] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ce8e9d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x23884f50, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x23884f50, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x274de0 [0234.393] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ce8e9d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x23884f50, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x23884f50, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0234.393] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ce8e9d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2ce8e9d0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2ce8e9d0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="gliding", cAlternateFileName="")) returned 1 [0234.393] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\gliding\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ce8e9d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2ce8e9d0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2ce8e9d0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37353231, dwReserved1=0x345f3533, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0234.393] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ce8e9d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2ce8e9d0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2ce8e9d0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37353231, dwReserved1=0x345f3533, cFileName="..", cAlternateFileName="")) returned 1 [0234.393] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ce8e9d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2ce8e9d0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2ce8e9d0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x37353231, dwReserved1=0x345f3533, cFileName="..", cAlternateFileName="")) returned 0 [0234.393] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0234.393] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d32b470, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x21cff0f0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x21cff0f0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1 [0234.394] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0234.394] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0234.395] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x462 [0234.395] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0234.395] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0234.455] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x462, lpOverlapped=0x0) returned 1 [0234.513] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x470, lpOverlapped=0x0) returned 1 [0234.514] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.580] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.592] CloseHandle (hObject=0xdc) returned 1 [0234.593] CloseHandle (hObject=0xe0) returned 1 [0234.593] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.ozq0")) returned 0 [0234.593] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.ozq0")) returned 0x2020 [0234.594] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d32b470, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x21cff0f0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x21cff0f0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 0x26dd48 [0234.594] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2d32b470, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x21cff0f0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x21cff0f0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 0 [0234.594] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0234.594] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\mapisvc.inf")) returned 1 [0234.595] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\mapisvc.inf")) returned 0xffffffff [0234.595] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23884f50, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x242a2cd0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x242a2cd0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1 [0234.595] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23884f50, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x242a2cd0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x242a2cd0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x275e28, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0234.596] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23884f50, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x242a2cd0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x242a2cd0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x275e28, cFileName="..", cAlternateFileName="")) returned 1 [0234.596] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x7e007c, dwReserved1=0x275e28, cFileName="Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat", cAlternateFileName="STREAM~3.DAT")) returned 1 [0234.597] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_availabilityoptions_2_75c5cb426a060443a982525df40ca7ef.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0234.597] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_availabilityoptions_2_75c5cb426a060443a982525df40ca7ef.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0234.598] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1a6 [0234.598] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0234.598] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0234.634] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1a6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1a6, lpOverlapped=0x0) returned 1 [0234.635] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0234.636] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.697] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.709] CloseHandle (hObject=0xdc) returned 1 [0234.709] CloseHandle (hObject=0xf8) returned 1 [0234.709] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_availabilityoptions_2_75c5cb426a060443a982525df40ca7ef.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_availabilityoptions_2_75c5cb426a060443a982525df40ca7ef.dat.ozq0")) returned 0 [0234.711] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_availabilityoptions_2_75c5cb426a060443a982525df40ca7ef.dat.ozq0")) returned 0x2020 [0234.711] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat", cAlternateFileName="STREAM~3.DAT")) returned 0x26dd88 [0234.711] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x1a6, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat", cAlternateFileName="STREAM~3.DAT")) returned 0 [0234.711] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0234.711] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_availabilityoptions_2_75c5cb426a060443a982525df40ca7ef.dat")) returned 1 [0234.712] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_AvailabilityOptions_2_75C5CB426A060443A982525DF40CA7EF.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_availabilityoptions_2_75c5cb426a060443a982525df40ca7ef.dat")) returned 0xffffffff [0234.712] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24256a10, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x24256a10, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat", cAlternateFileName="STREAM~2.DAT")) returned 1 [0234.712] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_calendar_2_cb55c2c1f45fed459e403036c0f2f1e7.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0234.713] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_calendar_2_cb55c2c1f45fed459e403036c0f2f1e7.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0234.713] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24c [0234.713] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0234.714] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0234.756] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x24c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x24c, lpOverlapped=0x0) returned 1 [0234.795] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x250, lpOverlapped=0x0) returned 1 [0234.796] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.866] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.879] CloseHandle (hObject=0xf8) returned 1 [0234.879] CloseHandle (hObject=0xdc) returned 1 [0234.879] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_calendar_2_cb55c2c1f45fed459e403036c0f2f1e7.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_calendar_2_cb55c2c1f45fed459e403036c0f2f1e7.dat.ozq0")) returned 0 [0234.880] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_calendar_2_cb55c2c1f45fed459e403036c0f2f1e7.dat.ozq0")) returned 0x2020 [0234.880] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24256a10, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x24256a10, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat", cAlternateFileName="STREAM~2.DAT")) returned 0x26dd88 [0234.880] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24256a10, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x24256a10, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat", cAlternateFileName="STREAM~2.DAT")) returned 0 [0234.880] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0234.880] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_calendar_2_cb55c2c1f45fed459e403036c0f2f1e7.dat")) returned 1 [0234.881] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_Calendar_2_CB55C2C1F45FED459E403036C0F2F1E7.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_calendar_2_cb55c2c1f45fed459e403036c0f2f1e7.dat")) returned 0xffffffff [0234.881] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat", cAlternateFileName="ST3BAF~1.DAT")) returned 1 [0234.881] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_conversationprefs_2_523db53cc2b7b64a8fac840db61db8ee.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0234.883] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_conversationprefs_2_523db53cc2b7b64a8fac840db61db8ee.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0234.884] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10b [0234.884] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0234.884] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0234.920] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x10b, lpOverlapped=0x0) returned 1 [0234.921] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0234.922] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0234.978] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0234.990] CloseHandle (hObject=0xdc) returned 1 [0234.990] CloseHandle (hObject=0xf8) returned 1 [0234.990] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_conversationprefs_2_523db53cc2b7b64a8fac840db61db8ee.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_conversationprefs_2_523db53cc2b7b64a8fac840db61db8ee.dat.ozq0")) returned 0 [0234.992] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_conversationprefs_2_523db53cc2b7b64a8fac840db61db8ee.dat.ozq0")) returned 0x2020 [0234.992] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat", cAlternateFileName="ST3BAF~1.DAT")) returned 0x26dd88 [0234.992] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat", cAlternateFileName="ST3BAF~1.DAT")) returned 0 [0234.992] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0234.993] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_conversationprefs_2_523db53cc2b7b64a8fac840db61db8ee.dat")) returned 1 [0234.993] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ConversationPrefs_2_523DB53CC2B7B64A8FAC840DB61DB8EE.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_conversationprefs_2_523db53cc2b7b64a8fac840db61db8ee.dat")) returned 0xffffffff [0234.994] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat", cAlternateFileName="ST6C14~1.DAT")) returned 1 [0234.994] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_rssrule_2_484261f764576d4095bc718a1e9a6b6d.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0234.995] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_rssrule_2_484261f764576d4095bc718a1e9a6b6d.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0234.996] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc4 [0234.996] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0234.996] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0235.030] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xc4, lpOverlapped=0x0) returned 1 [0235.031] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd0, lpOverlapped=0x0) returned 1 [0235.032] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.102] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.116] CloseHandle (hObject=0xf8) returned 1 [0235.116] CloseHandle (hObject=0xdc) returned 1 [0235.117] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_rssrule_2_484261f764576d4095bc718a1e9a6b6d.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_rssrule_2_484261f764576d4095bc718a1e9a6b6d.dat.ozq0")) returned 0 [0235.117] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_rssrule_2_484261f764576d4095bc718a1e9a6b6d.dat.ozq0")) returned 0x2020 [0235.118] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat", cAlternateFileName="ST6C14~1.DAT")) returned 0x26dd88 [0235.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xc4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat", cAlternateFileName="ST6C14~1.DAT")) returned 0 [0235.118] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0235.118] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_rssrule_2_484261f764576d4095bc718a1e9a6b6d.dat")) returned 1 [0235.119] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_RssRule_2_484261F764576D4095BC718A1E9A6B6D.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_rssrule_2_484261f764576d4095bc718a1e9a6b6d.dat")) returned 0xffffffff [0235.119] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x242a2cd0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x242a2cd0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x242a2cd0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat", cAlternateFileName="ST5D96~1.DAT")) returned 1 [0235.119] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tableviewpreviewprefs_2_7e96cff05aa1ab4f91e2dcf307336a81.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0235.120] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tableviewpreviewprefs_2_7e96cff05aa1ab4f91e2dcf307336a81.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0235.120] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11c [0235.120] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0235.121] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0235.154] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x11c, lpOverlapped=0x0) returned 1 [0235.155] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0235.156] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.219] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.232] CloseHandle (hObject=0xdc) returned 1 [0235.232] CloseHandle (hObject=0xf8) returned 1 [0235.232] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tableviewpreviewprefs_2_7e96cff05aa1ab4f91e2dcf307336a81.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tableviewpreviewprefs_2_7e96cff05aa1ab4f91e2dcf307336a81.dat.ozq0")) returned 0 [0235.232] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tableviewpreviewprefs_2_7e96cff05aa1ab4f91e2dcf307336a81.dat.ozq0")) returned 0x2020 [0235.233] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x242a2cd0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x242a2cd0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x242a2cd0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat", cAlternateFileName="ST5D96~1.DAT")) returned 0x26dd88 [0235.233] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x242a2cd0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x242a2cd0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x242a2cd0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat", cAlternateFileName="ST5D96~1.DAT")) returned 0 [0235.233] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0235.233] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tableviewpreviewprefs_2_7e96cff05aa1ab4f91e2dcf307336a81.dat")) returned 1 [0235.234] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TableViewPreviewPrefs_2_7E96CFF05AA1AB4F91E2DCF307336A81.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tableviewpreviewprefs_2_7e96cff05aa1ab4f91e2dcf307336a81.dat")) returned 0xffffffff [0235.234] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x238ab0b0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x238ab0b0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x238ab0b0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat", cAlternateFileName="STREAM~1.DAT")) returned 1 [0235.234] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tcprefs_2_ec28410e7b2cda4ab38c0bc60099b183.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0235.235] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tcprefs_2_ec28410e7b2cda4ab38c0bc60099b183.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0235.236] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcc [0235.236] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0235.236] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0235.271] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xcc, lpOverlapped=0x0) returned 1 [0235.272] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd0, lpOverlapped=0x0) returned 1 [0235.273] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.338] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.353] CloseHandle (hObject=0xf8) returned 1 [0235.354] CloseHandle (hObject=0xdc) returned 1 [0235.354] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tcprefs_2_ec28410e7b2cda4ab38c0bc60099b183.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tcprefs_2_ec28410e7b2cda4ab38c0bc60099b183.dat.ozq0")) returned 0 [0235.355] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tcprefs_2_ec28410e7b2cda4ab38c0bc60099b183.dat.ozq0")) returned 0x2020 [0235.355] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x238ab0b0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x238ab0b0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x238ab0b0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat", cAlternateFileName="STREAM~1.DAT")) returned 0x26dd88 [0235.355] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x238ab0b0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x238ab0b0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x238ab0b0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat", cAlternateFileName="STREAM~1.DAT")) returned 0 [0235.355] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0235.355] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tcprefs_2_ec28410e7b2cda4ab38c0bc60099b183.dat")) returned 1 [0235.356] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_TCPrefs_2_EC28410E7B2CDA4AB38C0BC60099B183.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_tcprefs_2_ec28410e7b2cda4ab38c0bc60099b183.dat")) returned 0xffffffff [0235.356] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat", cAlternateFileName="STREAM~4.DAT")) returned 1 [0235.356] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_workhours_1_0b01bfe21da49b4a926a43db70edb003.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0235.357] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_workhours_1_0b01bfe21da49b4a926a43db70edb003.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0235.358] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27c [0235.358] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0235.358] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0235.389] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x27c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x27c, lpOverlapped=0x0) returned 1 [0235.500] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x280, lpOverlapped=0x0) returned 1 [0235.502] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.559] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.571] CloseHandle (hObject=0xdc) returned 1 [0235.572] CloseHandle (hObject=0xf8) returned 1 [0235.572] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_workhours_1_0b01bfe21da49b4a926a43db70edb003.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_workhours_1_0b01bfe21da49b4a926a43db70edb003.dat.ozq0")) returned 0 [0235.572] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_workhours_1_0b01bfe21da49b4a926a43db70edb003.dat.ozq0")) returned 0x2020 [0235.573] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat", cAlternateFileName="STREAM~4.DAT")) returned 0x26dd88 [0235.573] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat", cAlternateFileName="STREAM~4.DAT")) returned 0 [0235.573] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0235.573] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_workhours_1_0b01bfe21da49b4a926a43db70edb003.dat")) returned 1 [0235.574] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_workhours_1_0b01bfe21da49b4a926a43db70edb003.dat")) returned 0xffffffff [0235.574] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2427cb70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x2427cb70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x2427cb70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x27c, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stream_WorkHours_1_0B01BFE21DA49B4A926A43DB70EDB003.dat", cAlternateFileName="STREAM~4.DAT")) returned 0 [0235.574] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0235.574] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x23884f50, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x242a2cd0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x242a2cd0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0 [0235.574] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0235.574] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xb1ed8fe0, ftLastAccessTime.dwHighDateTime=0x1d73a91, ftLastWriteTime.dwLowDateTime=0xb1ed8fe0, ftLastWriteTime.dwHighDateTime=0x1d73a91, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x65303265, dwReserved1=0x61432073, cFileName="Windows", cAlternateFileName="")) returned 1 [0235.574] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xb1ed8fe0, ftLastAccessTime.dwHighDateTime=0x1d73a91, ftLastWriteTime.dwLowDateTime=0xb1ed8fe0, ftLastWriteTime.dwHighDateTime=0x1d73a91, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72756f48, dwReserved1=0x5f315f73, cFileName=".", cAlternateFileName="")) returned 0x274de0 [0235.574] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xb1ed8fe0, ftLastAccessTime.dwHighDateTime=0x1d73a91, ftLastWriteTime.dwLowDateTime=0xb1ed8fe0, ftLastWriteTime.dwHighDateTime=0x1d73a91, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72756f48, dwReserved1=0x5f315f73, cFileName="..", cAlternateFileName="")) returned 1 [0235.574] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x107d8460, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x10aabe80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x10aabe80, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72756f48, dwReserved1=0x5f315f73, cFileName="1033", cAlternateFileName="")) returned 1 [0235.574] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x107d8460, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x10aabe80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x10aabe80, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0235.575] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x107d8460, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x10aabe80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x10aabe80, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0235.575] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10aabe80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x10aabe80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x10ad1fe0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x48a3b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1 [0235.576] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0235.576] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0235.577] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48a3b [0235.577] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0235.577] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0235.612] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x48a3b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x48a3b, lpOverlapped=0x0) returned 1 [0235.702] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x48a40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x48a40, lpOverlapped=0x0) returned 1 [0235.708] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.765] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.777] CloseHandle (hObject=0xf8) returned 1 [0235.777] CloseHandle (hObject=0xdc) returned 1 [0235.778] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.ozq0")) returned 0 [0235.778] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.ozq0")) returned 0x2020 [0235.778] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10aabe80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x10aabe80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x10ad1fe0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x48a3b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0x26dd88 [0235.779] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10aabe80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x10aabe80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x10ad1fe0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x48a3b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0235.779] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0235.779] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 1 [0235.782] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 0xffffffff [0235.782] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x10aabe80, ftCreationTime.dwHighDateTime=0x1d706a9, ftLastAccessTime.dwLowDateTime=0x10aabe80, ftLastAccessTime.dwHighDateTime=0x1d706a9, ftLastWriteTime.dwLowDateTime=0x10ad1fe0, ftLastWriteTime.dwHighDateTime=0x1d706a9, nFileSizeHigh=0x0, nFileSizeLow=0x48a3b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0 [0235.782] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0235.782] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x46c35e30, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c35e30, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Burn", cAlternateFileName="")) returned 1 [0235.782] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x46c35e30, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c35e30, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0235.782] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x46c35e30, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c35e30, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0235.783] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Burn", cAlternateFileName="")) returned 1 [0235.783] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0235.783] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0235.783] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0235.783] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0235.783] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0235.787] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0235.787] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0235.787] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0235.816] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xae, lpOverlapped=0x0) returned 1 [0235.817] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xb0, lpOverlapped=0x0) returned 1 [0235.818] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0235.873] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0235.885] CloseHandle (hObject=0xf8) returned 1 [0235.885] CloseHandle (hObject=0xe8) returned 1 [0235.885] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.ozq0")) returned 0 [0235.885] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.ozq0")) returned 0x20 [0235.886] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e38 [0235.886] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0235.886] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0235.886] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 1 [0235.887] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0xffffffff [0235.887] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x79b5b110, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b5b110, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa400a2, dwReserved1=0x276e30, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0235.887] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0235.888] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9284afd0, ftCreationTime.dwHighDateTime=0x1d7050d, ftLastAccessTime.dwLowDateTime=0x92863670, ftLastAccessTime.dwHighDateTime=0x1d7050d, ftLastWriteTime.dwLowDateTime=0x92865d80, ftLastWriteTime.dwHighDateTime=0x1d7050d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Burn1", cAlternateFileName="")) returned 1 [0235.888] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9284afd0, ftCreationTime.dwHighDateTime=0x1d7050d, ftLastAccessTime.dwLowDateTime=0x92863670, ftLastAccessTime.dwHighDateTime=0x1d7050d, ftLastWriteTime.dwLowDateTime=0x92865d80, ftLastWriteTime.dwHighDateTime=0x1d7050d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0235.888] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9284afd0, ftCreationTime.dwHighDateTime=0x1d7050d, ftLastAccessTime.dwLowDateTime=0x92863670, ftLastAccessTime.dwHighDateTime=0x1d7050d, ftLastWriteTime.dwLowDateTime=0x92865d80, ftLastWriteTime.dwHighDateTime=0x1d7050d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0235.888] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92863670, ftCreationTime.dwHighDateTime=0x1d7050d, ftLastAccessTime.dwLowDateTime=0x92863670, ftLastAccessTime.dwHighDateTime=0x1d7050d, ftLastWriteTime.dwLowDateTime=0x92865d80, ftLastWriteTime.dwHighDateTime=0x1d7050d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0235.889] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0235.889] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0235.890] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0235.890] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0235.891] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0235.937] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xae, lpOverlapped=0x0) returned 1 [0235.938] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xb0, lpOverlapped=0x0) returned 1 [0235.940] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.007] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.019] CloseHandle (hObject=0xe8) returned 1 [0236.019] CloseHandle (hObject=0xf8) returned 1 [0236.019] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.ozq0")) returned 0 [0236.021] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.ozq0")) returned 0x20 [0236.021] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92863670, ftCreationTime.dwHighDateTime=0x1d7050d, ftLastAccessTime.dwLowDateTime=0x92863670, ftLastAccessTime.dwHighDateTime=0x1d7050d, ftLastWriteTime.dwLowDateTime=0x92865d80, ftLastWriteTime.dwHighDateTime=0x1d7050d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e38 [0236.021] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92863670, ftCreationTime.dwHighDateTime=0x1d7050d, ftLastAccessTime.dwLowDateTime=0x92863670, ftLastAccessTime.dwHighDateTime=0x1d7050d, ftLastWriteTime.dwLowDateTime=0x92865d80, ftLastWriteTime.dwHighDateTime=0x1d7050d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0236.021] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0236.021] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 1 [0236.023] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 0xffffffff [0236.023] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92863670, ftCreationTime.dwHighDateTime=0x1d7050d, ftLastAccessTime.dwLowDateTime=0x92863670, ftLastAccessTime.dwHighDateTime=0x1d7050d, ftLastWriteTime.dwLowDateTime=0x92865d80, ftLastWriteTime.dwHighDateTime=0x1d7050d, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0236.024] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0236.024] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x46c35e30, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x46c3d360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c3fa70, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Burn2", cAlternateFileName="")) returned 1 [0236.024] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x46c35e30, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x46c3d360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c3fa70, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0236.024] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x46c35e30, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x46c3d360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c3fa70, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0236.024] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x46c3d360, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x46c3d360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c3fa70, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0236.025] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0236.025] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.028] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae [0236.028] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0236.029] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0236.059] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0xae, lpOverlapped=0x0) returned 1 [0236.060] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xb0, lpOverlapped=0x0) returned 1 [0236.061] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.119] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.132] CloseHandle (hObject=0xf8) returned 1 [0236.132] CloseHandle (hObject=0xe8) returned 1 [0236.133] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.ozq0")) returned 0 [0236.133] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.ozq0")) returned 0x20 [0236.133] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x46c3d360, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x46c3d360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c3fa70, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e38 [0236.134] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x46c3d360, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x46c3d360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c3fa70, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0236.134] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0236.134] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 1 [0236.135] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 0xffffffff [0236.135] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x46c3d360, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x46c3d360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c3fa70, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0236.135] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0236.135] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x46c35e30, ftCreationTime.dwHighDateTime=0x1d7a944, ftLastAccessTime.dwLowDateTime=0x46c3d360, ftLastAccessTime.dwHighDateTime=0x1d7a944, ftLastWriteTime.dwLowDateTime=0x46c3fa70, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Burn2", cAlternateFileName="")) returned 0 [0236.135] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0236.135] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x462fb4a0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x462fb4a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x79726575, dwReserved1=0x65686353, cFileName="Caches", cAlternateFileName="")) returned 1 [0236.135] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x462fb4a0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x462fb4a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0236.136] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x798152d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x462fb4a0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x462fb4a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0236.136] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x495965f0, ftCreationTime.dwHighDateTime=0x1d706af, ftLastAccessTime.dwLowDateTime=0x495965f0, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x495965f0, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1 [0236.136] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0236.136] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.137] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0236.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0236.138] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0236.169] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4000, lpOverlapped=0x0) returned 1 [0236.170] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4010, lpOverlapped=0x0) returned 1 [0236.171] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.231] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.244] CloseHandle (hObject=0xdc) returned 1 [0236.244] CloseHandle (hObject=0xe8) returned 1 [0236.244] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.ozq0")) returned 0 [0236.245] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.ozq0")) returned 0x2020 [0236.245] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x495965f0, ftCreationTime.dwHighDateTime=0x1d706af, ftLastAccessTime.dwLowDateTime=0x495965f0, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x495965f0, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 0x26dd88 [0236.245] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x495965f0, ftCreationTime.dwHighDateTime=0x1d706af, ftLastAccessTime.dwLowDateTime=0x495965f0, ftLastAccessTime.dwHighDateTime=0x1d706af, ftLastWriteTime.dwLowDateTime=0x495965f0, ftLastWriteTime.dwHighDateTime=0x1d706af, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 0 [0236.245] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0236.245] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 1 [0236.246] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0xffffffff [0236.246] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x937198a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x937198a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x937198a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x162a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db", cAlternateFileName="{AFBF9~3.DB")) returned 1 [0236.247] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.248] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0236.249] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x162a8 [0236.249] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0236.249] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0236.293] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x162a8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x162a8, lpOverlapped=0x0) returned 1 [0236.335] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x162b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x162b0, lpOverlapped=0x0) returned 1 [0236.337] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.410] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.425] CloseHandle (hObject=0xe8) returned 1 [0236.425] CloseHandle (hObject=0xdc) returned 1 [0236.425] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db.ozq0")) returned 0 [0236.426] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db.ozq0")) returned 0x2020 [0236.426] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x937198a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x937198a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x937198a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x162a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db", cAlternateFileName="{AFBF9~3.DB")) returned 0x26dd88 [0236.426] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x937198a0, ftCreationTime.dwHighDateTime=0x1d73a90, ftLastAccessTime.dwLowDateTime=0x937198a0, ftLastAccessTime.dwHighDateTime=0x1d73a90, ftLastWriteTime.dwLowDateTime=0x937198a0, ftLastWriteTime.dwHighDateTime=0x1d73a90, nFileSizeHigh=0x0, nFileSizeLow=0x162a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db", cAlternateFileName="{AFBF9~3.DB")) returned 0 [0236.426] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0236.427] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db")) returned 1 [0236.429] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000006.db")) returned 0xffffffff [0236.429] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x462fb4a0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x462fb4a0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x462fb4a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x16a58, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db", cAlternateFileName="{AFBF9~1.DB")) returned 1 [0236.429] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0236.429] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.454] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a58 [0236.454] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0236.455] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0236.487] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x16a58, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x16a58, lpOverlapped=0x0) returned 1 [0236.492] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x16a60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x16a60, lpOverlapped=0x0) returned 1 [0236.494] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.558] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.571] CloseHandle (hObject=0xdc) returned 1 [0236.572] CloseHandle (hObject=0xe8) returned 1 [0236.572] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db.ozq0")) returned 0 [0236.572] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db.ozq0")) returned 0x2020 [0236.572] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x462fb4a0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x462fb4a0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x462fb4a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x16a58, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db", cAlternateFileName="{AFBF9~1.DB")) returned 0x26dd88 [0236.573] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x462fb4a0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x462fb4a0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x462fb4a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x16a58, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db", cAlternateFileName="{AFBF9~1.DB")) returned 0 [0236.573] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0236.573] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db")) returned 0 [0236.573] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000007.db")) returned 0x2020 [0236.573] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x462fb4a0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x462fb4a0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x462fb4a0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x16a58, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db", cAlternateFileName="{AFBF9~1.DB")) returned 0 [0236.573] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0236.573] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d384545, dwReserved1=0x37374334, cFileName="Explorer", cAlternateFileName="")) returned 1 [0236.573] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0236.573] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0236.573] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x822c2a40, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1 [0236.574] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.574] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0236.575] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6000 [0236.575] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0236.576] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0236.605] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x6000, lpOverlapped=0x0) returned 1 [0236.890] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x6010, lpOverlapped=0x0) returned 1 [0236.892] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0236.968] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0236.982] CloseHandle (hObject=0xe8) returned 1 [0236.982] CloseHandle (hObject=0xdc) returned 1 [0236.982] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.ozq0")) returned 0 [0236.983] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.ozq0")) returned 0x2020 [0236.983] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x822c2a40, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 0x26dd88 [0236.983] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x822c2a40, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 0 [0236.983] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0236.983] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl")) returned 1 [0236.984] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl")) returned 0xffffffff [0236.984] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b5b0470, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1 [0236.985] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0236.986] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0236.986] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0236.986] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0236.987] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0237.016] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4000, lpOverlapped=0x0) returned 1 [0237.175] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4010, lpOverlapped=0x0) returned 1 [0237.177] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.236] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.248] CloseHandle (hObject=0xdc) returned 1 [0237.248] CloseHandle (hObject=0xe8) returned 1 [0237.248] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.ozq0")) returned 0 [0237.249] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.ozq0")) returned 0x2020 [0237.249] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b5b0470, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 0x26dd88 [0237.249] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b5b0470, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 0 [0237.249] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0237.249] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl")) returned 1 [0237.250] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl")) returned 0xffffffff [0237.250] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1 [0237.251] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0237.251] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0237.252] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0237.252] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0237.252] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0237.280] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0237.281] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0237.282] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.346] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.366] CloseHandle (hObject=0xe8) returned 1 [0237.366] CloseHandle (hObject=0xdc) returned 1 [0237.366] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.ozq0")) returned 0 [0237.367] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.ozq0")) returned 0x2020 [0237.367] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 0x26dd88 [0237.367] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 0 [0237.367] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0237.367] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 1 [0237.368] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 0xffffffff [0237.368] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 1 [0237.369] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0237.369] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0237.370] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0237.370] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0237.370] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0237.399] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0237.472] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0237.492] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.550] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.563] CloseHandle (hObject=0xdc) returned 1 [0237.563] CloseHandle (hObject=0xe8) returned 1 [0237.563] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.ozq0")) returned 0 [0237.564] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.ozq0")) returned 0x2020 [0237.564] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 0x26dd88 [0237.564] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="thumbcache_256.db", cAlternateFileName="TH5A2B~1.DB")) returned 0 [0237.564] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0237.564] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 1 [0237.574] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0xffffffff [0237.574] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 1 [0237.574] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0237.574] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0237.575] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0237.575] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0237.576] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0237.614] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0237.633] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0237.654] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0237.711] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0237.723] CloseHandle (hObject=0xe8) returned 1 [0237.723] CloseHandle (hObject=0xdc) returned 1 [0237.724] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.ozq0")) returned 0 [0237.724] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.ozq0")) returned 0x2020 [0237.724] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 0x26dd88 [0237.725] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~4.DB")) returned 0 [0237.725] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0237.725] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 1 [0237.734] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0xffffffff [0237.734] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1 [0237.734] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0237.734] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0237.735] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x100000 [0237.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0237.735] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0237.778] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x100000, lpOverlapped=0x0) returned 1 [0238.229] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100010, lpOverlapped=0x0) returned 1 [0238.250] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.307] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.320] CloseHandle (hObject=0xdc) returned 1 [0238.320] CloseHandle (hObject=0xe8) returned 1 [0238.320] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.ozq0")) returned 0 [0238.321] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.ozq0")) returned 0x2020 [0238.321] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 0x26dd88 [0238.321] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 0 [0238.321] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0238.321] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 1 [0238.338] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0xffffffff [0238.338] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 1 [0238.339] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.339] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0238.340] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xcb8 [0238.340] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0238.340] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0238.371] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xcb8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xcb8, lpOverlapped=0x0) returned 1 [0238.372] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xcc0, lpOverlapped=0x0) returned 1 [0238.373] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.439] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.452] CloseHandle (hObject=0xe8) returned 1 [0238.452] CloseHandle (hObject=0xdc) returned 1 [0238.452] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.ozq0")) returned 0 [0238.453] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.ozq0")) returned 0x2020 [0238.453] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 0x26dd88 [0238.453] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x17dc6ba, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~2.DB")) returned 0 [0238.453] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0238.453] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 1 [0238.455] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0xffffffff [0238.455] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 1 [0238.456] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0238.456] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.457] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0238.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0238.457] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0238.486] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18, lpOverlapped=0x0) returned 1 [0238.487] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0238.488] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.562] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.575] CloseHandle (hObject=0xdc) returned 1 [0238.575] CloseHandle (hObject=0xe8) returned 1 [0238.575] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.ozq0")) returned 0 [0238.575] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.ozq0")) returned 0x2020 [0238.576] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0x26dd88 [0238.576] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0 [0238.576] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0238.576] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 1 [0238.577] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0xffffffff [0238.577] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x182897a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="thumbcache_sr.db", cAlternateFileName="THUMBC~1.DB")) returned 0 [0238.577] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0238.577] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0238.577] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0238.578] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0238.578] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0238.578] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0238.578] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x797c9010, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="History", cAlternateFileName="")) returned 1 [0238.578] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x797c9010, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0238.578] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x797c9010, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0238.578] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0238.579] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.579] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0238.580] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0238.580] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0238.580] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0238.610] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x91, lpOverlapped=0x0) returned 1 [0238.611] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa0, lpOverlapped=0x0) returned 1 [0238.611] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0238.667] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0238.679] CloseHandle (hObject=0xe8) returned 1 [0238.680] CloseHandle (hObject=0xdc) returned 1 [0238.680] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.ozq0")) returned 0 [0238.680] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.ozq0")) returned 0x2020 [0238.680] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dd88 [0238.681] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0238.681] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0238.681] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 1 [0238.682] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0xffffffff [0238.682] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5e446d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0238.682] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5e446d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0238.682] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5e446d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e008c, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0238.682] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x8e008c, dwReserved1=0x276e30, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0238.682] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0238.683] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.095] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x91 [0239.096] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0239.096] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0239.137] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x91, lpOverlapped=0x0) returned 1 [0239.195] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0xa0, lpOverlapped=0x0) returned 1 [0239.197] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.271] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.289] CloseHandle (hObject=0xe8) returned 1 [0239.289] CloseHandle (hObject=0xf8) returned 1 [0239.290] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.ozq0")) returned 0 [0239.290] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.ozq0")) returned 0x2020 [0239.291] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277ee8 [0239.291] FindNextFileA (in: hFindFile=0x277ee8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.291] FindClose (in: hFindFile=0x277ee8 | out: hFindFile=0x277ee8) returned 1 [0239.291] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 1 [0239.292] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0xffffffff [0239.293] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x28c9c8b0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="index.dat", cAlternateFileName="")) returned 1 [0239.293] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.293] CloseHandle (hObject=0xffffffff) returned 0 [0239.293] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.ozq0")) returned 0 [0239.294] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.ozq0")) returned 0xffffffff [0239.294] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x28c9c8b0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0x277ee8 [0239.294] FindNextFileA (in: hFindFile=0x277ee8, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x28c9c8b0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0239.294] FindClose (in: hFindFile=0x277ee8 | out: hFindFile=0x277ee8) returned 1 [0239.294] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 0 [0239.294] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 0x2026 [0239.294] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e446d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5e446d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="MSHist012022022520220226", cAlternateFileName="MSHIST~1")) returned 1 [0239.294] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022022520220226\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e446d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5e446d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa200a0, dwReserved1=0x277e38, cFileName=".", cAlternateFileName="")) returned 0x277f08 [0239.295] FindNextFileA (in: hFindFile=0x277f08, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e446d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5e446d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa200a0, dwReserved1=0x277e38, cFileName="..", cAlternateFileName="")) returned 1 [0239.295] FindNextFileA (in: hFindFile=0x277f08, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5e446d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x28c9c8b0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa200a0, dwReserved1=0x277e38, cFileName="index.dat", cAlternateFileName="")) returned 1 [0239.295] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022022520220226\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012022022520220226\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.295] CloseHandle (hObject=0xffffffff) returned 0 [0239.296] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022022520220226\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012022022520220226\\index.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022022520220226\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012022022520220226\\index.dat.ozq0")) returned 0 [0239.296] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022022520220226\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012022022520220226\\index.dat.ozq0")) returned 0xffffffff [0239.296] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022022520220226\\index.dat", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5e446d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x28c9c8b0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0x277e38 [0239.296] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5e446d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x28c9c8b0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0239.296] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0239.296] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022022520220226\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012022022520220226\\index.dat")) returned 0 [0239.296] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012022022520220226\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012022022520220226\\index.dat")) returned 0x2026 [0239.297] FindNextFileA (in: hFindFile=0x277f08, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x5e446d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x28c9c8b0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa200a0, dwReserved1=0x277e38, cFileName="index.dat", cAlternateFileName="")) returned 0 [0239.297] FindClose (in: hFindFile=0x277f08 | out: hFindFile=0x277f08) returned 1 [0239.297] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e446d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5e446d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5e446d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="MSHist012022022520220226", cAlternateFileName="MSHIST~1")) returned 0 [0239.297] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0239.297] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32323032, dwReserved1=0x32303235, cFileName="Low", cAlternateFileName="")) returned 1 [0239.297] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0239.298] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0239.298] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 0 [0239.298] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0239.298] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x797ef170, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x797ef170, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32323032, dwReserved1=0x32303235, cFileName="Low", cAlternateFileName="")) returned 0 [0239.298] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0239.298] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb1ed8fe0, ftCreationTime.dwHighDateTime=0x1d73a91, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xa18da600, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x642e7273, dwReserved1=0x5f626262, cFileName="PowerShell", cAlternateFileName="POWERS~1")) returned 1 [0239.298] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb1ed8fe0, ftCreationTime.dwHighDateTime=0x1d73a91, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xa18da600, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32323032, dwReserved1=0x32303235, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0239.301] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb1ed8fe0, ftCreationTime.dwHighDateTime=0x1d73a91, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xa18da600, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32323032, dwReserved1=0x32303235, cFileName="..", cAlternateFileName="")) returned 1 [0239.301] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xa1900760, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x3511, dwReserved0=0x32323032, dwReserved1=0x32303235, cFileName="ModuleAnalysisCache", cAlternateFileName="MODULE~1")) returned 1 [0239.302] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa18da600, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0xa18da600, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xa1900760, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x3511, dwReserved0=0x32323032, dwReserved1=0x32303235, cFileName="ModuleAnalysisCache", cAlternateFileName="MODULE~1")) returned 0 [0239.302] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0239.302] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7977cd50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7977cd50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43736973, dwReserved1=0x65686361, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0239.302] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7977cd50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7977cd50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x680063, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0239.303] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7977cd50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7977cd50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x680063, cFileName="..", cAlternateFileName="")) returned 1 [0239.303] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7977cd50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7977cd50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x680063, cFileName="..", cAlternateFileName="")) returned 0 [0239.303] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0239.303] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xb10c4320, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xb10c4320, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43736973, dwReserved1=0x65686361, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0239.303] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xb10c4320, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xb10c4320, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x680063, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0239.303] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xb10c4320, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0xb10c4320, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x680063, cFileName="..", cAlternateFileName="")) returned 1 [0239.303] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x680063, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0239.303] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0239.304] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0239.304] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0239.304] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.305] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0239.306] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0239.306] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0239.307] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0239.358] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x43, lpOverlapped=0x0) returned 1 [0239.359] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x50, lpOverlapped=0x0) returned 1 [0239.360] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.420] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.433] CloseHandle (hObject=0xf8) returned 1 [0239.433] CloseHandle (hObject=0xe8) returned 1 [0239.433] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.ozq0")) returned 0 [0239.434] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.ozq0")) returned 0x2020 [0239.434] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277f08 [0239.434] FindNextFileA (in: hFindFile=0x277f08, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.434] FindClose (in: hFindFile=0x277f08 | out: hFindFile=0x277f08) returned 1 [0239.434] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0239.435] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0xffffffff [0239.435] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x577d0b90, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="index.dat", cAlternateFileName="")) returned 1 [0239.435] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0239.435] CloseHandle (hObject=0xffffffff) returned 0 [0239.435] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.ozq0")) returned 0 [0239.436] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.ozq0")) returned 0xffffffff [0239.436] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x577d0b90, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0x277f08 [0239.436] FindNextFileA (in: hFindFile=0x277f08, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x577d0b90, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0239.436] FindClose (in: hFindFile=0x277f08 | out: hFindFile=0x277f08) returned 1 [0239.436] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 0 [0239.436] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 0x2026 [0239.436] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79756bf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1 [0239.436] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79756bf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x277e38, cFileName=".", cAlternateFileName="")) returned 0x277f10 [0239.436] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79756bf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc400c2, dwReserved1=0x277e38, cFileName="..", cAlternateFileName="")) returned 1 [0239.437] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc400c2, dwReserved1=0x277e38, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0239.437] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.438] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0239.439] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0239.439] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0239.439] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0239.482] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0239.483] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0239.484] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.544] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.556] CloseHandle (hObject=0xf8) returned 1 [0239.556] CloseHandle (hObject=0xf4) returned 1 [0239.557] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.ozq0")) returned 0 [0239.557] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.ozq0")) returned 0x2020 [0239.557] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e38 [0239.558] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.558] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0239.558] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 1 [0239.559] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0xffffffff [0239.559] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b34fb0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b34fb0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0xc400c2, dwReserved1=0x277e38, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.559] FindClose (in: hFindFile=0x277f10 | out: hFindFile=0x277f10) returned 1 [0239.559] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79730a90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1 [0239.559] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79730a90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName=".", cAlternateFileName="")) returned 0x277f10 [0239.559] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79730a90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="..", cAlternateFileName="")) returned 1 [0239.559] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0239.560] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0239.561] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.561] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0239.562] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0239.562] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0239.611] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0239.612] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0239.613] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.674] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.686] CloseHandle (hObject=0xf4) returned 1 [0239.686] CloseHandle (hObject=0xf8) returned 1 [0239.686] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.ozq0")) returned 0 [0239.687] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.ozq0")) returned 0x2020 [0239.688] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e38 [0239.688] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.688] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0239.688] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 1 [0239.689] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0xffffffff [0239.689] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.689] FindClose (in: hFindFile=0x277f10 | out: hFindFile=0x277f10) returned 1 [0239.689] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7970a930, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1 [0239.689] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7970a930, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName=".", cAlternateFileName="")) returned 0x277f10 [0239.689] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7970a930, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="..", cAlternateFileName="")) returned 1 [0239.689] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0239.690] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.690] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0239.691] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0239.692] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0239.692] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0239.734] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0239.735] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0239.736] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.797] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.809] CloseHandle (hObject=0xf8) returned 1 [0239.809] CloseHandle (hObject=0xf4) returned 1 [0239.809] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.ozq0")) returned 0 [0239.810] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.ozq0")) returned 0x2020 [0239.810] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e38 [0239.810] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.810] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0239.810] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 1 [0239.811] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0xffffffff [0239.811] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.812] FindClose (in: hFindFile=0x277f10 | out: hFindFile=0x277f10) returned 1 [0239.812] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="X9OHK109", cAlternateFileName="")) returned 1 [0239.812] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName=".", cAlternateFileName="")) returned 0x277f10 [0239.813] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="..", cAlternateFileName="")) returned 1 [0239.813] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0239.813] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0239.815] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0239.816] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0239.816] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0239.816] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0239.859] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x43, lpOverlapped=0x0) returned 1 [0239.860] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x50, lpOverlapped=0x0) returned 1 [0239.861] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0239.922] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0239.934] CloseHandle (hObject=0xf4) returned 1 [0239.934] CloseHandle (hObject=0xf8) returned 1 [0239.934] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.ozq0")) returned 0 [0239.935] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.ozq0")) returned 0x2020 [0239.935] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e38 [0239.935] FindNextFileA (in: hFindFile=0x277e38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.935] FindClose (in: hFindFile=0x277e38 | out: hFindFile=0x277e38) returned 1 [0239.935] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 1 [0239.936] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0xffffffff [0239.936] FindNextFileA (in: hFindFile=0x277f10, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0239.936] FindClose (in: hFindFile=0x277f10 | out: hFindFile=0x277f10) returned 1 [0239.936] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x965da2a0, ftLastAccessTime.dwHighDateTime=0x1d7e780, ftLastWriteTime.dwLowDateTime=0x965da2a0, ftLastWriteTime.dwHighDateTime=0x1d7e780, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="X9OHK109", cAlternateFileName="")) returned 0 [0239.936] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0239.936] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x1f663bf0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x1f663bf0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x1f663bf0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x680063, cFileName="Content.MSO", cAlternateFileName="")) returned 1 [0239.936] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x1f663bf0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x1f663bf0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x1f663bf0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0239.937] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x1f663bf0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x1f663bf0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x1f663bf0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0239.937] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x1f663bf0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x1f663bf0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x1f663bf0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 0 [0239.937] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0239.937] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xb10c4320, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x3e37ba40, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x3e37ba40, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x610063, dwReserved1=0x680063, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1 [0239.937] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xb10c4320, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x3e37ba40, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x43defe40, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0239.938] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xb10c4320, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x3e37ba40, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x43defe40, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 1 [0239.938] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xb10c4320, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x3e37ba40, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x43defe40, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="..", cAlternateFileName="")) returned 0 [0239.938] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0239.938] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x610063, dwReserved1=0x680063, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0239.938] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0239.939] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0239.940] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43 [0239.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0239.940] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0239.982] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x43, lpOverlapped=0x0) returned 1 [0239.984] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x50, lpOverlapped=0x0) returned 1 [0239.985] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.048] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.060] CloseHandle (hObject=0xdc) returned 1 [0240.060] CloseHandle (hObject=0xe8) returned 1 [0240.060] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.ozq0")) returned 0 [0240.061] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.ozq0")) returned 0x2020 [0240.061] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x26dd88 [0240.061] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0240.061] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0240.061] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 1 [0240.062] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0xffffffff [0240.062] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0240.062] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb000ae, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0240.063] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb000ae, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0240.063] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedb45673, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb000ae, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 0 [0240.063] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0240.063] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1 [0240.063] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb000ae, dwReserved1=0x276e30, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0240.064] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb000ae, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 1 [0240.064] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb000ae, dwReserved1=0x276e30, cFileName="..", cAlternateFileName="")) returned 0 [0240.064] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0240.064] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0240.064] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.064] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd49789d0, ftCreationTime.dwHighDateTime=0x1d72469, ftLastAccessTime.dwLowDateTime=0xd49789d0, ftLastAccessTime.dwHighDateTime=0x1d72469, ftLastWriteTime.dwLowDateTime=0xd49789d0, ftLastWriteTime.dwHighDateTime=0x1d72469, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x43736964, dwReserved1=0x65686361, cFileName="Themes", cAlternateFileName="")) returned 1 [0240.064] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd49789d0, ftCreationTime.dwHighDateTime=0x1d72469, ftLastAccessTime.dwLowDateTime=0xd49789d0, ftLastAccessTime.dwHighDateTime=0x1d72469, ftLastWriteTime.dwLowDateTime=0xd49789d0, ftLastWriteTime.dwHighDateTime=0x1d72469, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0240.065] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd49789d0, ftCreationTime.dwHighDateTime=0x1d72469, ftLastAccessTime.dwLowDateTime=0xd49789d0, ftLastAccessTime.dwHighDateTime=0x1d72469, ftLastWriteTime.dwLowDateTime=0xd49789d0, ftLastWriteTime.dwHighDateTime=0x1d72469, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0240.065] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd49789d0, ftCreationTime.dwHighDateTime=0x1d72469, ftLastAccessTime.dwLowDateTime=0xd49789d0, ftLastAccessTime.dwHighDateTime=0x1d72469, ftLastWriteTime.dwLowDateTime=0x38f50c40, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x70b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0240.065] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\themes\\custom.theme"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0240.065] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0240.066] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x70b [0240.066] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0240.066] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0240.110] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x70b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x70b, lpOverlapped=0x0) returned 1 [0240.210] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x710, lpOverlapped=0x0) returned 1 [0240.211] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.274] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.290] CloseHandle (hObject=0xe8) returned 1 [0240.290] CloseHandle (hObject=0xdc) returned 1 [0240.290] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\themes\\custom.theme"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.ozq0")) returned 0 [0240.291] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.ozq0")) returned 0x2020 [0240.291] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd49789d0, ftCreationTime.dwHighDateTime=0x1d72469, ftLastAccessTime.dwLowDateTime=0xd49789d0, ftLastAccessTime.dwHighDateTime=0x1d72469, ftLastWriteTime.dwLowDateTime=0x38f50c40, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x70b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0x26dd88 [0240.291] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd49789d0, ftCreationTime.dwHighDateTime=0x1d72469, ftLastAccessTime.dwLowDateTime=0xd49789d0, ftLastAccessTime.dwHighDateTime=0x1d72469, ftLastWriteTime.dwLowDateTime=0x38f50c40, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x70b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0 [0240.291] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0240.291] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\themes\\custom.theme")) returned 1 [0240.293] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\themes\\custom.theme")) returned 0xffffffff [0240.293] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd49789d0, ftCreationTime.dwHighDateTime=0x1d72469, ftLastAccessTime.dwLowDateTime=0xd49789d0, ftLastAccessTime.dwHighDateTime=0x1d72469, ftLastWriteTime.dwLowDateTime=0x38f50c40, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x70b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0 [0240.293] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.293] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x60d6a850, ftLastAccessTime.dwHighDateTime=0x1d82a26, ftLastWriteTime.dwLowDateTime=0x2efa5aa0, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x43736965, dwReserved1=0x65686361, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0240.293] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.294] CloseHandle (hObject=0xffffffff) returned 0 [0240.294] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.ozq0")) returned 0 [0240.294] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.ozq0")) returned 0xffffffff [0240.294] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x60d6a850, ftLastAccessTime.dwHighDateTime=0x1d82a26, ftLastWriteTime.dwLowDateTime=0x2efa5aa0, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 0x26dd48 [0240.294] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x60d6a850, ftLastAccessTime.dwHighDateTime=0x1d82a26, ftLastWriteTime.dwLowDateTime=0x2efa5aa0, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 0 [0240.294] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.294] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0 [0240.294] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat")) returned 0x22 [0240.295] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2ef7f940, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1 [0240.295] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.295] CloseHandle (hObject=0xffffffff) returned 0 [0240.295] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1.ozq0")) returned 0 [0240.295] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1.ozq0")) returned 0xffffffff [0240.295] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2ef7f940, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 0x26dd48 [0240.295] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2ef7f940, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 0 [0240.296] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.296] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1")) returned 0 [0240.296] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1")) returned 0x2026 [0240.296] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1 [0240.296] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.296] CloseHandle (hObject=0xffffffff) returned 0 [0240.296] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2.ozq0")) returned 0 [0240.296] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2.ozq0")) returned 0xffffffff [0240.297] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 0x26dd48 [0240.297] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79b0ee50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79b0ee50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 0 [0240.297] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.297] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2")) returned 0 [0240.297] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2")) returned 0x2026 [0240.297] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1 [0240.297] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.298] CloseHandle (hObject=0xffffffff) returned 0 [0240.298] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf.ozq0")) returned 0 [0240.298] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf.ozq0")) returned 0xffffffff [0240.298] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 0x26dd48 [0240.298] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 0 [0240.298] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.298] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf")) returned 0 [0240.298] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf")) returned 0x2026 [0240.298] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1 [0240.299] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.299] CloseHandle (hObject=0xffffffff) returned 0 [0240.299] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms.ozq0")) returned 0 [0240.299] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms.ozq0")) returned 0xffffffff [0240.299] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 0x26dd48 [0240.299] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 0 [0240.300] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.300] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms")) returned 0 [0240.300] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x2026 [0240.300] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1 [0240.300] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0240.301] CloseHandle (hObject=0xffffffff) returned 0 [0240.301] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms.ozq0")) returned 0 [0240.301] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms.ozq0")) returned 0xffffffff [0240.301] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 0x26dd48 [0240.301] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 0 [0240.301] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.301] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms")) returned 0 [0240.301] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x2026 [0240.301] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="WER", cAlternateFileName="")) returned 1 [0240.301] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1240122, dwReserved1=0x275e28, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0240.302] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1240122, dwReserved1=0x275e28, cFileName="..", cAlternateFileName="")) returned 1 [0240.302] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1240122, dwReserved1=0x275e28, cFileName="ERC", cAlternateFileName="")) returned 1 [0240.302] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0240.302] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName="..", cAlternateFileName="")) returned 1 [0240.303] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName="..", cAlternateFileName="")) returned 0 [0240.303] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0240.303] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1240122, dwReserved1=0x275e28, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0240.303] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0240.303] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName="..", cAlternateFileName="")) returned 1 [0240.303] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66002d, dwReserved1=0x310035, cFileName="..", cAlternateFileName="")) returned 0 [0240.303] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0240.303] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796e47d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1240122, dwReserved1=0x275e28, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0 [0240.303] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.303] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796e47d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="WER", cAlternateFileName="")) returned 0 [0240.303] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0240.304] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8cddad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8d03c30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8d03c30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66307b74, dwReserved1=0x61376436, cFileName="Windows Live", cAlternateFileName="WINDOW~4")) returned 1 [0240.304] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8cddad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8d03c30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8d03c30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0240.304] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8cddad0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8d03c30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8d03c30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0240.304] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d03c30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf52e20f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf52e20f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName="Bici", cAlternateFileName="")) returned 1 [0240.304] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d03c30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf52e20f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf52e20f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1240122, dwReserved1=0x275e28, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0240.305] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d03c30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf52e20f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf52e20f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1240122, dwReserved1=0x275e28, cFileName="..", cAlternateFileName="")) returned 1 [0240.305] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2adcf10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2adcf10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2adcf10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x1240122, dwReserved1=0x275e28, cFileName="_00.sqm", cAlternateFileName="")) returned 1 [0240.305] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_00.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_00.sqm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0240.306] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_00.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_00.sqm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0240.306] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x450 [0240.306] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0240.307] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0240.538] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x450, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x450, lpOverlapped=0x0) returned 1 [0240.549] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x460, lpOverlapped=0x0) returned 1 [0240.551] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.610] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.625] CloseHandle (hObject=0xdc) returned 1 [0240.625] CloseHandle (hObject=0xe8) returned 1 [0240.629] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_00.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_00.sqm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_00.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_00.sqm.ozq0")) returned 0 [0240.630] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_00.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_00.sqm.ozq0")) returned 0x2020 [0240.630] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_00.sqm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2adcf10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2adcf10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2adcf10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="_00.sqm", cAlternateFileName="")) returned 0x276e88 [0240.630] FindNextFileA (in: hFindFile=0x276e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2adcf10, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf2adcf10, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf2adcf10, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="_00.sqm", cAlternateFileName="")) returned 0 [0240.630] FindClose (in: hFindFile=0x276e88 | out: hFindFile=0x276e88) returned 1 [0240.630] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_00.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_00.sqm")) returned 1 [0240.631] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_00.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_00.sqm")) returned 0xffffffff [0240.631] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="_01.sqm", cAlternateFileName="")) returned 1 [0240.634] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_01.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_01.sqm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0240.640] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_01.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_01.sqm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0240.641] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x338 [0240.641] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0240.641] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0240.699] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x338, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x338, lpOverlapped=0x0) returned 1 [0240.720] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x340, lpOverlapped=0x0) returned 1 [0240.721] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.781] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.793] CloseHandle (hObject=0xe8) returned 1 [0240.793] CloseHandle (hObject=0xdc) returned 1 [0240.793] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_01.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_01.sqm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_01.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_01.sqm.ozq0")) returned 0 [0240.794] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_01.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_01.sqm.ozq0")) returned 0x2020 [0240.794] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_01.sqm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="_01.sqm", cAlternateFileName="")) returned 0x276e88 [0240.794] FindNextFileA (in: hFindFile=0x276e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf3011f30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf3011f30, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf3011f30, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="_01.sqm", cAlternateFileName="")) returned 0 [0240.794] FindClose (in: hFindFile=0x276e88 | out: hFindFile=0x276e88) returned 1 [0240.794] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_01.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_01.sqm")) returned 1 [0240.796] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_01.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_01.sqm")) returned 0xffffffff [0240.796] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf41a0170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf41a0170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf41a0170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="_02.sqm", cAlternateFileName="")) returned 1 [0240.796] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_02.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_02.sqm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0240.796] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_02.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_02.sqm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0240.838] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2fe [0240.838] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0240.838] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0240.887] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2fe, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2fe, lpOverlapped=0x0) returned 1 [0240.909] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x300, lpOverlapped=0x0) returned 1 [0240.911] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0240.966] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0240.978] CloseHandle (hObject=0xdc) returned 1 [0240.978] CloseHandle (hObject=0xe8) returned 1 [0240.978] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_02.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_02.sqm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_02.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_02.sqm.ozq0")) returned 0 [0240.979] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_02.sqm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_02.sqm.ozq0")) returned 0x2020 [0240.979] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_02.sqm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf41a0170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf41a0170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf41a0170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="_02.sqm", cAlternateFileName="")) returned 0x276e88 [0240.979] FindNextFileA (in: hFindFile=0x276e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf41a0170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf41a0170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf41a0170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="_02.sqm", cAlternateFileName="")) returned 0 [0240.979] FindClose (in: hFindFile=0x276e88 | out: hFindFile=0x276e88) returned 1 [0240.979] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_02.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_02.sqm")) returned 1 [0240.980] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Live\\Bici\\_02.sqm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows live\\bici\\_02.sqm")) returned 0xffffffff [0240.980] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf41a0170, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf41a0170, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf41a0170, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="_02.sqm", cAlternateFileName="")) returned 0 [0240.980] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0240.980] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d03c30, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xf52e20f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xf52e20f0, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName="Bici", cAlternateFileName="")) returned 0 [0240.980] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0240.981] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7d4ee530, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d4ee530, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x66307b74, dwReserved1=0x61376436, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1 [0240.981] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7d4ee530, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d4ee530, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0241.062] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7d4ee530, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d4ee530, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0241.062] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x76f76576, dwReserved1=0x76653c7d, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1 [0241.062] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0241.063] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0241.063] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5e4 [0241.064] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0241.064] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0241.105] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5e4, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x5e4, lpOverlapped=0x0) returned 1 [0241.289] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x5f0, lpOverlapped=0x0) returned 1 [0241.290] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.349] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.360] CloseHandle (hObject=0xe0) returned 1 [0241.360] CloseHandle (hObject=0xe8) returned 1 [0241.361] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ozq0")) returned 0 [0241.361] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ozq0")) returned 0x2020 [0241.361] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 0x26dd88 [0241.362] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 0 [0241.362] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0241.362] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount")) returned 1 [0241.363] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount")) returned 0xffffffff [0241.363] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1 [0241.363] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0241.364] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0241.364] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a0 [0241.364] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0241.364] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0241.407] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2a0, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2a0, lpOverlapped=0x0) returned 1 [0241.410] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2b0, lpOverlapped=0x0) returned 1 [0241.419] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0241.478] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0241.493] CloseHandle (hObject=0xe8) returned 1 [0241.493] CloseHandle (hObject=0xe0) returned 1 [0241.493] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ozq0")) returned 0 [0241.494] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ozq0")) returned 0x2020 [0241.494] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 0x26dd88 [0241.494] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 0 [0241.494] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0241.494] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount")) returned 1 [0241.495] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount")) returned 0xffffffff [0241.495] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1 [0241.496] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0241.496] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0241.497] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6c8 [0241.497] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0241.497] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0241.953] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6c8, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x6c8, lpOverlapped=0x0) returned 1 [0242.053] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x6d0, lpOverlapped=0x0) returned 1 [0242.055] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.113] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.125] CloseHandle (hObject=0xe0) returned 1 [0242.125] CloseHandle (hObject=0xe8) returned 1 [0242.125] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ozq0")) returned 0 [0242.126] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ozq0")) returned 0x2020 [0242.126] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 0x26dd88 [0242.126] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 0 [0242.127] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0242.127] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount")) returned 1 [0242.128] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount")) returned 0xffffffff [0242.128] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796be670, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Backup", cAlternateFileName="")) returned 1 [0242.128] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796be670, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe000de, dwReserved1=0x275de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0242.128] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796be670, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf303882f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe000de, dwReserved1=0x275de8, cFileName="..", cAlternateFileName="")) returned 1 [0242.128] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe000de, dwReserved1=0x275de8, cFileName="new", cAlternateFileName="")) returned 1 [0242.128] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34002d, dwReserved1=0x330036, cFileName=".", cAlternateFileName="")) returned 0x276e88 [0242.129] FindNextFileA (in: hFindFile=0x276e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34002d, dwReserved1=0x330036, cFileName="..", cAlternateFileName="")) returned 1 [0242.129] FindNextFileA (in: hFindFile=0x276e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x34002d, dwReserved1=0x330036, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0242.129] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0242.129] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0242.228] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0242.228] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0242.229] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0242.272] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x200000, lpOverlapped=0x0) returned 1 [0242.329] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x200010, lpOverlapped=0x0) returned 1 [0242.374] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.449] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.461] CloseHandle (hObject=0xdc) returned 1 [0242.461] CloseHandle (hObject=0xf8) returned 1 [0242.462] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log.ozq0")) returned 0 [0242.463] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log.ozq0")) returned 0x2020 [0242.463] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="edb00001.log", cAlternateFileName="")) returned 0x276df0 [0242.463] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="edb00001.log", cAlternateFileName="")) returned 0 [0242.463] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0242.463] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log")) returned 1 [0242.473] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\edb00001.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\edb00001.log")) returned 0xffffffff [0242.473] FindNextFileA (in: hFindFile=0x276e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0242.473] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0242.475] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0242.476] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x206000 [0242.476] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0242.476] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0242.545] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x206000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x206000, lpOverlapped=0x0) returned 1 [0242.754] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x206010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x206010, lpOverlapped=0x0) returned 1 [0242.792] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0242.853] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0242.864] CloseHandle (hObject=0xf8) returned 1 [0242.865] CloseHandle (hObject=0xdc) returned 1 [0242.865] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore.ozq0")) returned 0 [0242.882] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore.ozq0")) returned 0x2020 [0242.882] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0x276df0 [0242.882] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0 [0242.882] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0242.882] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore")) returned 1 [0242.884] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.msmessagestore")) returned 0xffffffff [0242.884] FindNextFileA (in: hFindFile=0x276e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0242.885] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0242.885] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0242.886] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0242.886] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0242.886] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0242.936] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x4000, lpOverlapped=0x0) returned 1 [0243.206] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x4010, lpOverlapped=0x0) returned 1 [0243.211] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.263] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.278] CloseHandle (hObject=0xdc) returned 1 [0243.278] CloseHandle (hObject=0xf8) returned 1 [0243.278] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat.ozq0")) returned 0 [0243.279] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat.ozq0")) returned 0x2020 [0243.280] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0x276df0 [0243.280] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0243.280] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0243.280] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat")) returned 1 [0243.281] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\new\\WindowsMail.pat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\backup\\new\\windowsmail.pat")) returned 0xffffffff [0243.282] FindNextFileA (in: hFindFile=0x276e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ae8cf0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0243.282] FindClose (in: hFindFile=0x276e88 | out: hFindFile=0x276e88) returned 1 [0243.282] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ae8cf0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe000de, dwReserved1=0x275de8, cFileName="new", cAlternateFileName="")) returned 0 [0243.282] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0243.282] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edb.chk", cAlternateFileName="")) returned 1 [0243.283] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0243.283] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.chk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0243.284] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2000 [0243.284] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0243.284] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0243.369] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x2000, lpOverlapped=0x0) returned 1 [0243.388] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x2010, lpOverlapped=0x0) returned 1 [0243.390] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.462] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.474] CloseHandle (hObject=0xe8) returned 1 [0243.474] CloseHandle (hObject=0xe0) returned 1 [0243.474] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.chk.ozq0")) returned 0 [0243.475] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.chk.ozq0")) returned 0x2020 [0243.475] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="edb.chk", cAlternateFileName="")) returned 0x26dd88 [0243.475] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79ac2b90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ac2b90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="edb.chk", cAlternateFileName="")) returned 0 [0243.475] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0243.475] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 1 [0243.476] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 0xffffffff [0243.476] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a9ca30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a9ca30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edb.log", cAlternateFileName="")) returned 1 [0243.477] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0243.477] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0243.478] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0243.478] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0243.478] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0243.520] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0243.631] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0243.671] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0243.725] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0243.757] CloseHandle (hObject=0xe0) returned 1 [0243.757] CloseHandle (hObject=0xe8) returned 1 [0243.758] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.log.ozq0")) returned 0 [0243.759] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.log.ozq0")) returned 0x2020 [0243.759] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a9ca30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a9ca30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="edb.log", cAlternateFileName="")) returned 0x26dd88 [0243.759] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a9ca30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a9ca30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="edb.log", cAlternateFileName="")) returned 0 [0243.759] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0243.759] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.log")) returned 1 [0243.769] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb.log")) returned 0xffffffff [0243.769] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a768d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a768d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edb00001.log", cAlternateFileName="")) returned 1 [0243.770] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0243.770] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb00001.log.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0243.771] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0243.771] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0243.771] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0243.821] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0243.934] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0243.972] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.022] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.034] CloseHandle (hObject=0xe8) returned 1 [0244.034] CloseHandle (hObject=0xe0) returned 1 [0244.034] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb00001.log.ozq0")) returned 0 [0244.035] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb00001.log.ozq0")) returned 0x2020 [0244.035] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a768d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a768d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="edb00001.log", cAlternateFileName="")) returned 0x26dd88 [0244.035] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a768d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a768d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="edb00001.log", cAlternateFileName="")) returned 0 [0244.035] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0244.035] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb00001.log")) returned 1 [0244.045] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edb00001.log")) returned 0xffffffff [0244.045] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1 [0244.045] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0244.046] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0244.046] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0244.046] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0244.047] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0244.096] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0244.216] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0244.272] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.324] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.335] CloseHandle (hObject=0xe0) returned 1 [0244.335] CloseHandle (hObject=0xe8) returned 1 [0244.336] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.ozq0")) returned 0 [0244.336] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.ozq0")) returned 0x2020 [0244.337] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 0x26dd88 [0244.337] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 0 [0244.337] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0244.337] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs")) returned 1 [0244.346] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs")) returned 0xffffffff [0244.346] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1 [0244.346] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0244.347] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0244.347] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x200000 [0244.347] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0244.348] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0244.397] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x200000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x200000, lpOverlapped=0x0) returned 1 [0244.537] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x200010, lpOverlapped=0x0) returned 1 [0244.585] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.640] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.653] CloseHandle (hObject=0xe8) returned 1 [0244.653] CloseHandle (hObject=0xe0) returned 1 [0244.653] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.ozq0")) returned 0 [0244.654] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.ozq0")) returned 0x2020 [0244.654] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 0x26dd88 [0244.654] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 0 [0244.654] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0244.654] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs")) returned 1 [0244.664] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs")) returned 0xffffffff [0244.664] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="oeold.xml", cAlternateFileName="")) returned 1 [0244.664] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0244.664] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\oeold.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0244.665] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x104 [0244.665] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0244.665] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0244.711] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x104, lpOverlapped=0x0) returned 1 [0244.711] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x110, lpOverlapped=0x0) returned 1 [0244.712] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.772] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.798] CloseHandle (hObject=0xe0) returned 1 [0244.798] CloseHandle (hObject=0xe8) returned 1 [0244.798] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\oeold.xml.ozq0")) returned 0 [0244.799] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\oeold.xml.ozq0")) returned 0x2020 [0244.799] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="oeold.xml", cAlternateFileName="")) returned 0x26dd88 [0244.799] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="oeold.xml", cAlternateFileName="")) returned 0 [0244.799] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0244.799] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\oeold.xml")) returned 1 [0244.800] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\oeold.xml")) returned 0xffffffff [0244.800] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0244.800] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x840082, dwReserved1=0x275de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0244.833] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796be670, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79ba73d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x840082, dwReserved1=0x275de8, cFileName="..", cAlternateFileName="")) returned 1 [0244.833] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x840082, dwReserved1=0x275de8, cFileName="Bears.htm", cAlternateFileName="")) returned 1 [0244.834] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0244.834] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0244.835] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xff [0244.835] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0244.835] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0244.881] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xff, lpOverlapped=0x0) returned 1 [0244.884] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100, lpOverlapped=0x0) returned 1 [0244.885] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0244.956] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0244.971] CloseHandle (hObject=0xe0) returned 1 [0244.971] CloseHandle (hObject=0xf8) returned 1 [0244.971] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.ozq0")) returned 0 [0244.972] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm.ozq0")) returned 0x2020 [0244.972] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Bears.htm", cAlternateFileName="")) returned 0x276e98 [0244.973] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a50770, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a50770, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Bears.htm", cAlternateFileName="")) returned 0 [0244.973] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0244.973] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm")) returned 1 [0244.974] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.htm")) returned 0xffffffff [0244.974] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Bears.jpg", cAlternateFileName="")) returned 1 [0244.974] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0244.975] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0244.976] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x432 [0244.976] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0244.976] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0245.043] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x432, lpOverlapped=0x0) returned 1 [0245.064] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x440, lpOverlapped=0x0) returned 1 [0245.065] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.124] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.137] CloseHandle (hObject=0xf8) returned 1 [0245.137] CloseHandle (hObject=0xe0) returned 1 [0245.137] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.ozq0")) returned 0 [0245.138] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg.ozq0")) returned 0x2020 [0245.138] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Bears.jpg", cAlternateFileName="")) returned 0x276e98 [0245.138] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Bears.jpg", cAlternateFileName="")) returned 0 [0245.138] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0245.138] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 1 [0245.139] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\bears.jpg")) returned 0xffffffff [0245.139] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0245.139] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.140] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.140] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x285 [0245.140] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0245.140] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0245.191] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x285, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x285, lpOverlapped=0x0) returned 1 [0245.192] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x290, lpOverlapped=0x0) returned 1 [0245.193] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.251] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.264] CloseHandle (hObject=0xe0) returned 1 [0245.264] CloseHandle (hObject=0xf8) returned 1 [0245.264] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.ozq0")) returned 0 [0245.265] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini.ozq0")) returned 0x2020 [0245.265] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0x276e98 [0245.265] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Desktop.ini", cAlternateFileName="")) returned 0 [0245.265] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0245.265] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 1 [0245.266] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\desktop.ini")) returned 0xffffffff [0245.266] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Garden.htm", cAlternateFileName="")) returned 1 [0245.267] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.268] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.268] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe7 [0245.268] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0245.269] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0245.313] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe7, lpOverlapped=0x0) returned 1 [0245.314] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0245.315] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.373] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.385] CloseHandle (hObject=0xf8) returned 1 [0245.385] CloseHandle (hObject=0xe0) returned 1 [0245.385] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.ozq0")) returned 0 [0245.386] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm.ozq0")) returned 0x2020 [0245.386] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Garden.htm", cAlternateFileName="")) returned 0x276e98 [0245.386] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Garden.htm", cAlternateFileName="")) returned 0 [0245.386] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0245.386] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm")) returned 1 [0245.387] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.htm")) returned 0xffffffff [0245.387] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Garden.jpg", cAlternateFileName="")) returned 1 [0245.387] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.388] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.389] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5d3f [0245.389] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0245.389] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0245.435] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x5d3f, lpOverlapped=0x0) returned 1 [0245.500] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x5d40, lpOverlapped=0x0) returned 1 [0245.501] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.578] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.590] CloseHandle (hObject=0xe0) returned 1 [0245.590] CloseHandle (hObject=0xf8) returned 1 [0245.590] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.ozq0")) returned 0 [0245.591] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg.ozq0")) returned 0x2020 [0245.591] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Garden.jpg", cAlternateFileName="")) returned 0x276e98 [0245.591] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Garden.jpg", cAlternateFileName="")) returned 0 [0245.591] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0245.591] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 1 [0245.592] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\garden.jpg")) returned 0xffffffff [0245.592] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1 [0245.593] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.593] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.593] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0245.593] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0245.594] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0245.635] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0245.636] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0245.637] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.701] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.714] CloseHandle (hObject=0xf8) returned 1 [0245.714] CloseHandle (hObject=0xe0) returned 1 [0245.714] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.ozq0")) returned 0 [0245.715] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm.ozq0")) returned 0x2020 [0245.715] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 0x276ea8 [0245.715] FindNextFileA (in: hFindFile=0x276ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 0 [0245.715] FindClose (in: hFindFile=0x276ea8 | out: hFindFile=0x276ea8) returned 1 [0245.715] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm")) returned 1 [0245.716] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\green bubbles.htm")) returned 0xffffffff [0245.716] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1 [0245.716] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.717] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.717] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1906 [0245.717] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0245.718] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0245.761] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1906, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1906, lpOverlapped=0x0) returned 1 [0245.831] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1910, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1910, lpOverlapped=0x0) returned 1 [0245.834] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0245.945] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0245.957] CloseHandle (hObject=0xe0) returned 1 [0245.957] CloseHandle (hObject=0xf8) returned 1 [0245.958] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ozq0")) returned 0 [0245.960] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ozq0")) returned 0x2020 [0245.960] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0x276ea0 [0245.960] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 0 [0245.960] FindClose (in: hFindFile=0x276ea0 | out: hFindFile=0x276ea0) returned 1 [0245.960] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 1 [0245.961] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\greenbubbles.jpg")) returned 0xffffffff [0245.962] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1 [0245.962] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0245.966] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0245.970] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xeb [0245.970] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0245.970] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0246.024] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xeb, lpOverlapped=0x0) returned 1 [0246.025] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0246.026] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.093] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.110] CloseHandle (hObject=0xf8) returned 1 [0246.110] CloseHandle (hObject=0xe0) returned 1 [0246.110] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.ozq0")) returned 0 [0246.111] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm.ozq0")) returned 0x2020 [0246.111] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 0x276ea0 [0246.111] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 0 [0246.111] FindClose (in: hFindFile=0x276ea0 | out: hFindFile=0x276ea0) returned 1 [0246.111] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm")) returned 1 [0246.113] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\hand prints.htm")) returned 0xffffffff [0246.113] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1 [0246.113] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0246.113] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0246.114] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x107e [0246.114] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0246.115] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0246.169] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x107e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x107e, lpOverlapped=0x0) returned 1 [0246.277] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1080, lpOverlapped=0x0) returned 1 [0246.279] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.338] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.350] CloseHandle (hObject=0xe0) returned 1 [0246.350] CloseHandle (hObject=0xf8) returned 1 [0246.350] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.ozq0")) returned 0 [0246.351] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg.ozq0")) returned 0x2020 [0246.351] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0x276ea0 [0246.351] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 0 [0246.351] FindClose (in: hFindFile=0x276ea0 | out: hFindFile=0x276ea0) returned 1 [0246.351] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 1 [0246.352] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\handprints.jpg")) returned 0xffffffff [0246.352] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1 [0246.353] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0246.353] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0246.354] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0246.354] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0246.354] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0246.405] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0246.406] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0246.407] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.464] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.477] CloseHandle (hObject=0xf8) returned 1 [0246.477] CloseHandle (hObject=0xe0) returned 1 [0246.477] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.ozq0")) returned 0 [0246.478] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm.ozq0")) returned 0x2020 [0246.478] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 0x276ea8 [0246.478] FindNextFileA (in: hFindFile=0x276ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 0 [0246.478] FindClose (in: hFindFile=0x276ea8 | out: hFindFile=0x276ea8) returned 1 [0246.478] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm")) returned 1 [0246.479] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orange circles.htm")) returned 0xffffffff [0246.479] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1 [0246.480] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0246.481] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0246.481] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18ed [0246.481] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0246.482] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0246.530] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18ed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18ed, lpOverlapped=0x0) returned 1 [0246.726] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x18f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x18f0, lpOverlapped=0x0) returned 1 [0246.728] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.790] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.802] CloseHandle (hObject=0xe0) returned 1 [0246.802] CloseHandle (hObject=0xf8) returned 1 [0246.803] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ozq0")) returned 0 [0246.803] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ozq0")) returned 0x2020 [0246.803] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0x276ea8 [0246.803] FindNextFileA (in: hFindFile=0x276ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 0 [0246.804] FindClose (in: hFindFile=0x276ea8 | out: hFindFile=0x276ea8) returned 1 [0246.804] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 1 [0246.805] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\orangecircles.jpg")) returned 0xffffffff [0246.805] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Peacock.htm", cAlternateFileName="")) returned 1 [0246.805] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0246.806] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0246.806] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0246.807] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0246.807] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0246.854] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe8, lpOverlapped=0x0) returned 1 [0246.855] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0246.856] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0246.916] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0246.928] CloseHandle (hObject=0xf8) returned 1 [0246.928] CloseHandle (hObject=0xe0) returned 1 [0246.928] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.ozq0")) returned 0 [0246.929] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm.ozq0")) returned 0x2020 [0246.929] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Peacock.htm", cAlternateFileName="")) returned 0x276e98 [0246.929] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Peacock.htm", cAlternateFileName="")) returned 0 [0246.929] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0246.929] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm")) returned 1 [0246.930] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.htm")) returned 0xffffffff [0246.930] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1 [0246.930] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0246.931] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0246.931] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13fb [0246.931] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0246.932] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0246.987] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x13fb, lpOverlapped=0x0) returned 1 [0246.995] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1400, lpOverlapped=0x0) returned 1 [0246.996] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.052] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.064] CloseHandle (hObject=0xe0) returned 1 [0247.064] CloseHandle (hObject=0xf8) returned 1 [0247.064] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.ozq0")) returned 0 [0247.065] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg.ozq0")) returned 0x2020 [0247.065] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0x276e98 [0247.066] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 0 [0247.066] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0247.066] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 1 [0247.067] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\peacock.jpg")) returned 0xffffffff [0247.067] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Roses.htm", cAlternateFileName="")) returned 1 [0247.067] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0247.068] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0247.068] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe9 [0247.068] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0247.069] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0247.116] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe9, lpOverlapped=0x0) returned 1 [0247.117] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0247.117] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.173] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.185] CloseHandle (hObject=0xf8) returned 1 [0247.185] CloseHandle (hObject=0xe0) returned 1 [0247.185] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.ozq0")) returned 0 [0247.186] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm.ozq0")) returned 0x2020 [0247.186] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Roses.htm", cAlternateFileName="")) returned 0x276e98 [0247.186] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Roses.htm", cAlternateFileName="")) returned 0 [0247.186] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0247.186] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm")) returned 1 [0247.187] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.htm")) returned 0xffffffff [0247.187] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Roses.jpg", cAlternateFileName="")) returned 1 [0247.188] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0247.189] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0247.190] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x780 [0247.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0247.190] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0247.236] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x780, lpOverlapped=0x0) returned 1 [0247.339] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x790, lpOverlapped=0x0) returned 1 [0247.341] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.402] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.413] CloseHandle (hObject=0xe0) returned 1 [0247.413] CloseHandle (hObject=0xf8) returned 1 [0247.413] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.ozq0")) returned 0 [0247.414] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg.ozq0")) returned 0x2020 [0247.414] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Roses.jpg", cAlternateFileName="")) returned 0x276e98 [0247.414] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Roses.jpg", cAlternateFileName="")) returned 0 [0247.414] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0247.415] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 1 [0247.419] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\roses.jpg")) returned 0xffffffff [0247.420] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1 [0247.420] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0247.420] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0247.421] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed [0247.421] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0247.421] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0247.466] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xed, lpOverlapped=0x0) returned 1 [0247.467] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0247.467] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.530] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.543] CloseHandle (hObject=0xf8) returned 1 [0247.543] CloseHandle (hObject=0xe0) returned 1 [0247.543] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.ozq0")) returned 0 [0247.544] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm.ozq0")) returned 0x2020 [0247.544] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 0x276ea8 [0247.544] FindNextFileA (in: hFindFile=0x276ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 0 [0247.544] FindClose (in: hFindFile=0x276ea8 | out: hFindFile=0x276ea8) returned 1 [0247.544] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm")) returned 1 [0247.545] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shades of blue.htm")) returned 0xffffffff [0247.545] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1 [0247.546] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0247.546] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0247.547] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x127e [0247.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0247.547] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0247.591] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x127e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x127e, lpOverlapped=0x0) returned 1 [0247.792] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1280, lpOverlapped=0x0) returned 1 [0247.795] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0247.873] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0247.885] CloseHandle (hObject=0xe0) returned 1 [0247.886] CloseHandle (hObject=0xf8) returned 1 [0247.886] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ozq0")) returned 0 [0247.888] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ozq0")) returned 0x2020 [0247.888] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0x276ea0 [0247.888] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 0 [0247.888] FindClose (in: hFindFile=0x276ea0 | out: hFindFile=0x276ea0) returned 1 [0247.888] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 1 [0247.892] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\shadesofblue.jpg")) returned 0xffffffff [0247.892] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1 [0247.892] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0247.899] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0247.900] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8 [0247.900] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0247.900] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0247.952] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe8, lpOverlapped=0x0) returned 1 [0247.957] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0247.958] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.012] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.024] CloseHandle (hObject=0xf8) returned 1 [0248.024] CloseHandle (hObject=0xe0) returned 1 [0248.024] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.ozq0")) returned 0 [0248.025] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm.ozq0")) returned 0x2020 [0248.025] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 0x276ea0 [0248.025] FindNextFileA (in: hFindFile=0x276ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 0 [0248.025] FindClose (in: hFindFile=0x276ea0 | out: hFindFile=0x276ea0) returned 1 [0248.025] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm")) returned 1 [0248.026] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\soft blue.htm")) returned 0xffffffff [0248.026] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1 [0248.027] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0248.027] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.027] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2949 [0248.027] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0248.028] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0248.075] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2949, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2949, lpOverlapped=0x0) returned 1 [0248.122] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2950, lpOverlapped=0x0) returned 1 [0248.123] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.179] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.206] CloseHandle (hObject=0xe0) returned 1 [0248.207] CloseHandle (hObject=0xf8) returned 1 [0248.207] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.ozq0")) returned 0 [0248.207] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg.ozq0")) returned 0x2020 [0248.208] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0x276e98 [0248.208] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a2a610, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a2a610, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 0 [0248.208] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0248.208] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 1 [0248.209] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\softblue.jpg")) returned 0xffffffff [0248.209] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stars.htm", cAlternateFileName="")) returned 1 [0248.209] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.210] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0248.210] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe6 [0248.210] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0248.211] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0248.261] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe6, lpOverlapped=0x0) returned 1 [0248.262] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf0, lpOverlapped=0x0) returned 1 [0248.263] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.340] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.351] CloseHandle (hObject=0xf8) returned 1 [0248.351] CloseHandle (hObject=0xe0) returned 1 [0248.352] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.ozq0")) returned 0 [0248.352] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm.ozq0")) returned 0x2020 [0248.352] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Stars.htm", cAlternateFileName="")) returned 0x276e98 [0248.352] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Stars.htm", cAlternateFileName="")) returned 0 [0248.352] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0248.353] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm")) returned 1 [0248.353] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.htm")) returned 0xffffffff [0248.360] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stars.jpg", cAlternateFileName="")) returned 1 [0248.361] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0248.361] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.362] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1d51 [0248.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0248.362] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0248.408] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1d51, lpOverlapped=0x0) returned 1 [0248.412] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d60, lpOverlapped=0x0) returned 1 [0248.413] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.475] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.488] CloseHandle (hObject=0xe0) returned 1 [0248.488] CloseHandle (hObject=0xf8) returned 1 [0248.488] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.ozq0")) returned 0 [0248.489] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg.ozq0")) returned 0x2020 [0248.489] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0x276e98 [0248.489] FindNextFileA (in: hFindFile=0x276e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0248.489] FindClose (in: hFindFile=0x276e98 | out: hFindFile=0x276e98) returned 1 [0248.489] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 1 [0248.490] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\stationery\\stars.jpg")) returned 0xffffffff [0248.490] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Stars.jpg", cAlternateFileName="")) returned 0 [0248.490] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0248.491] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x706a6d67, dwReserved1=0x766d7467, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1 [0248.491] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0248.491] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.492] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x204000 [0248.492] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0248.492] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0248.541] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x204000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x204000, lpOverlapped=0x0) returned 1 [0248.695] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x204010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x204010, lpOverlapped=0x0) returned 1 [0248.740] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0248.794] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0248.806] CloseHandle (hObject=0xe8) returned 1 [0248.806] CloseHandle (hObject=0xf8) returned 1 [0248.806] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.ozq0")) returned 0 [0248.807] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.ozq0")) returned 0x2020 [0248.807] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0x26dd88 [0248.807] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7d53a7f0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 0 [0248.807] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0248.807] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore")) returned 1 [0248.809] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore")) returned 0xffffffff [0248.809] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1 [0248.809] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0248.810] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0248.810] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4000 [0248.811] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0248.811] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0248.871] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4000, lpOverlapped=0x0) returned 1 [0248.993] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4010, lpOverlapped=0x0) returned 1 [0248.995] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.054] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.066] CloseHandle (hObject=0xf8) returned 1 [0249.066] CloseHandle (hObject=0xe8) returned 1 [0249.066] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.ozq0")) returned 0 [0249.067] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat.ozq0")) returned 0x2020 [0249.067] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0x26dd88 [0249.067] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0249.067] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0249.067] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat")) returned 1 [0249.068] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat")) returned 0xffffffff [0249.068] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2e234eb, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0 [0249.068] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0249.069] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1 [0249.069] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0249.070] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0249.070] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="12.0", cAlternateFileName="")) returned 1 [0249.070] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0249.070] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="..", cAlternateFileName="")) returned 1 [0249.070] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x90008e, dwReserved1=0x275de8, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1 [0249.071] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.071] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0249.072] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f2 [0249.072] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0249.072] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0249.119] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1f2, lpOverlapped=0x0) returned 1 [0249.120] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x200, lpOverlapped=0x0) returned 1 [0249.121] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.179] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.202] CloseHandle (hObject=0xf8) returned 1 [0249.202] CloseHandle (hObject=0xe0) returned 1 [0249.202] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ozq0")) returned 0 [0249.203] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ozq0")) returned 0x2020 [0249.203] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 0x276df0 [0249.204] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 0 [0249.204] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0249.204] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd")) returned 1 [0249.205] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.dtd")) returned 0xffffffff [0249.205] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1 [0249.205] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0249.205] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.206] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x27cf [0249.206] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0249.206] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0249.253] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x27cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x27cf, lpOverlapped=0x0) returned 1 [0249.300] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x27d0, lpOverlapped=0x0) returned 1 [0249.301] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.374] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.385] CloseHandle (hObject=0xe0) returned 1 [0249.385] CloseHandle (hObject=0xf8) returned 1 [0249.386] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.ozq0")) returned 0 [0249.386] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml.ozq0")) returned 0x2020 [0249.386] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0x276df0 [0249.387] FindNextFileA (in: hFindFile=0x276df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0249.387] FindClose (in: hFindFile=0x276df0 | out: hFindFile=0x276df0) returned 1 [0249.387] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml")) returned 1 [0249.388] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows media\\12.0\\wmsdkns.xml")) returned 0xffffffff [0249.388] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0 [0249.388] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0249.388] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="12.0", cAlternateFileName="")) returned 0 [0249.388] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0249.388] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1 [0249.388] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0249.389] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0249.389] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0249.389] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0249.389] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0249.389] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79698510, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0249.389] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0249.389] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Settings.ini", cAlternateFileName="")) returned 1 [0249.390] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0249.390] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.391] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54 [0249.391] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0249.391] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0249.440] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x54, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x54, lpOverlapped=0x0) returned 1 [0249.441] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x60, lpOverlapped=0x0) returned 1 [0249.442] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.506] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.519] CloseHandle (hObject=0xe8) returned 1 [0249.519] CloseHandle (hObject=0xf8) returned 1 [0249.519] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows sidebar\\settings.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.ozq0")) returned 0 [0249.520] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows sidebar\\settings.ini.ozq0")) returned 0x2020 [0249.520] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Settings.ini", cAlternateFileName="")) returned 0x26dd88 [0249.520] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0249.520] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0249.520] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 1 [0249.521] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Microsoft\\Windows Sidebar\\Settings.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\microsoft\\windows sidebar\\settings.ini")) returned 0xffffffff [0249.521] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Settings.ini", cAlternateFileName="")) returned 0 [0249.521] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0249.521] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7461702e, dwReserved1=0x61737365, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0 [0249.521] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0249.521] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x110e000, ftLastAccessTime.dwHighDateTime=0x1d856c9, ftLastWriteTime.dwLowDateTime=0x110e000, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72616265, dwReserved1=0x76657265, cFileName="Temp", cAlternateFileName="")) returned 1 [0249.521] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x110e000, ftLastAccessTime.dwHighDateTime=0x1d856c9, ftLastWriteTime.dwLowDateTime=0x110e000, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName=".", cAlternateFileName="")) returned 0x26dcb0 [0249.522] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79698510, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x110e000, ftLastAccessTime.dwHighDateTime=0x1d856c9, ftLastWriteTime.dwLowDateTime=0x110e000, ftLastWriteTime.dwHighDateTime=0x1d856c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="..", cAlternateFileName="")) returned 1 [0249.522] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15bd1270, ftCreationTime.dwHighDateTime=0x1d824b6, ftLastAccessTime.dwLowDateTime=0xd41eea20, ftLastAccessTime.dwHighDateTime=0x1d8258a, ftLastWriteTime.dwLowDateTime=0xd41eea20, ftLastWriteTime.dwHighDateTime=0x1d8258a, nFileSizeHigh=0x0, nFileSizeLow=0x1405f, dwReserved0=0x74617069, dwReserved1=0x61737365, cFileName="0y5QgL3kKnoc.mp4", cAlternateFileName="0Y5QGL~1.MP4")) returned 1 [0249.522] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\0y5QgL3kKnoc.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\0y5qgl3kknoc.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0249.522] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\0y5QgL3kKnoc.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\0y5qgl3kknoc.mp4.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.523] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1405f [0249.523] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0249.524] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0249.572] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1405f, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1405f, lpOverlapped=0x0) returned 1 [0249.574] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x14060, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x14060, lpOverlapped=0x0) returned 1 [0249.576] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.638] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.650] CloseHandle (hObject=0xec) returned 1 [0249.650] CloseHandle (hObject=0xf8) returned 1 [0249.650] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\0y5QgL3kKnoc.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\0y5qgl3kknoc.mp4"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\0y5QgL3kKnoc.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\0y5qgl3kknoc.mp4.ozq0")) returned 0 [0249.651] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\0y5QgL3kKnoc.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\0y5qgl3kknoc.mp4.ozq0")) returned 0x2020 [0249.651] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\0y5QgL3kKnoc.mp4", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15bd1270, ftCreationTime.dwHighDateTime=0x1d824b6, ftLastAccessTime.dwLowDateTime=0xd41eea20, ftLastAccessTime.dwHighDateTime=0x1d8258a, ftLastWriteTime.dwLowDateTime=0xd41eea20, ftLastWriteTime.dwHighDateTime=0x1d8258a, nFileSizeHigh=0x0, nFileSizeLow=0x1405f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="0y5QgL3kKnoc.mp4", cAlternateFileName="0Y5QGL~1.MP4")) returned 0x274de0 [0249.651] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15bd1270, ftCreationTime.dwHighDateTime=0x1d824b6, ftLastAccessTime.dwLowDateTime=0xd41eea20, ftLastAccessTime.dwHighDateTime=0x1d8258a, ftLastWriteTime.dwLowDateTime=0xd41eea20, ftLastWriteTime.dwHighDateTime=0x1d8258a, nFileSizeHigh=0x0, nFileSizeLow=0x1405f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="0y5QgL3kKnoc.mp4", cAlternateFileName="0Y5QGL~1.MP4")) returned 0 [0249.651] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0249.652] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\0y5QgL3kKnoc.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\0y5qgl3kknoc.mp4")) returned 1 [0249.653] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\0y5QgL3kKnoc.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\0y5qgl3kknoc.mp4")) returned 0xffffffff [0249.653] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce828840, ftCreationTime.dwHighDateTime=0x1d820ff, ftLastAccessTime.dwLowDateTime=0x7ce1a120, ftLastAccessTime.dwHighDateTime=0x1d8252c, ftLastWriteTime.dwLowDateTime=0x7ce1a120, ftLastWriteTime.dwHighDateTime=0x1d8252c, nFileSizeHigh=0x0, nFileSizeLow=0x26a3, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="1LU CTckI.bmp", cAlternateFileName="1LUCTC~1.BMP")) returned 1 [0249.654] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1LU CTckI.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1lu ctcki.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.654] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1LU CTckI.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1lu ctcki.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0249.655] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26a3 [0249.656] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0249.656] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0249.708] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x26a3, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x26a3, lpOverlapped=0x0) returned 1 [0249.709] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x26b0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x26b0, lpOverlapped=0x0) returned 1 [0249.710] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.769] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.781] CloseHandle (hObject=0xf8) returned 1 [0249.781] CloseHandle (hObject=0xec) returned 1 [0249.781] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1LU CTckI.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1lu ctcki.bmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1LU CTckI.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1lu ctcki.bmp.ozq0")) returned 0 [0249.782] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1LU CTckI.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1lu ctcki.bmp.ozq0")) returned 0x2020 [0249.782] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1LU CTckI.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce828840, ftCreationTime.dwHighDateTime=0x1d820ff, ftLastAccessTime.dwLowDateTime=0x7ce1a120, ftLastAccessTime.dwHighDateTime=0x1d8252c, ftLastWriteTime.dwLowDateTime=0x7ce1a120, ftLastWriteTime.dwHighDateTime=0x1d8252c, nFileSizeHigh=0x0, nFileSizeLow=0x26a3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1LU CTckI.bmp", cAlternateFileName="1LUCTC~1.BMP")) returned 0x274de0 [0249.782] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce828840, ftCreationTime.dwHighDateTime=0x1d820ff, ftLastAccessTime.dwLowDateTime=0x7ce1a120, ftLastAccessTime.dwHighDateTime=0x1d8252c, ftLastWriteTime.dwLowDateTime=0x7ce1a120, ftLastWriteTime.dwHighDateTime=0x1d8252c, nFileSizeHigh=0x0, nFileSizeLow=0x26a3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1LU CTckI.bmp", cAlternateFileName="1LUCTC~1.BMP")) returned 0 [0249.782] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0249.782] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1LU CTckI.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1lu ctcki.bmp")) returned 1 [0249.783] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\1LU CTckI.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\1lu ctcki.bmp")) returned 0xffffffff [0249.783] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1a80e10, ftCreationTime.dwHighDateTime=0x1d824b0, ftLastAccessTime.dwLowDateTime=0xa84b7b90, ftLastAccessTime.dwHighDateTime=0x1d825bf, ftLastWriteTime.dwLowDateTime=0xa84b7b90, ftLastWriteTime.dwHighDateTime=0x1d825bf, nFileSizeHigh=0x0, nFileSizeLow=0x8a59, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="2siERJLUo.mkv", cAlternateFileName="2SIERJ~1.MKV")) returned 1 [0249.784] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2siERJLUo.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2sierjluo.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0249.784] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2siERJLUo.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2sierjluo.mkv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.785] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8a59 [0249.785] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0249.785] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0249.832] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8a59, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x8a59, lpOverlapped=0x0) returned 1 [0249.833] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x8a60, lpOverlapped=0x0) returned 1 [0249.834] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0249.903] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0249.914] CloseHandle (hObject=0xec) returned 1 [0249.914] CloseHandle (hObject=0xf8) returned 1 [0249.914] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2siERJLUo.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2sierjluo.mkv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2siERJLUo.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2sierjluo.mkv.ozq0")) returned 0 [0249.915] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2siERJLUo.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2sierjluo.mkv.ozq0")) returned 0x2020 [0249.915] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2siERJLUo.mkv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1a80e10, ftCreationTime.dwHighDateTime=0x1d824b0, ftLastAccessTime.dwLowDateTime=0xa84b7b90, ftLastAccessTime.dwHighDateTime=0x1d825bf, ftLastWriteTime.dwLowDateTime=0xa84b7b90, ftLastWriteTime.dwHighDateTime=0x1d825bf, nFileSizeHigh=0x0, nFileSizeLow=0x8a59, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2siERJLUo.mkv", cAlternateFileName="2SIERJ~1.MKV")) returned 0x274de0 [0249.915] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc1a80e10, ftCreationTime.dwHighDateTime=0x1d824b0, ftLastAccessTime.dwLowDateTime=0xa84b7b90, ftLastAccessTime.dwHighDateTime=0x1d825bf, ftLastWriteTime.dwLowDateTime=0xa84b7b90, ftLastWriteTime.dwHighDateTime=0x1d825bf, nFileSizeHigh=0x0, nFileSizeLow=0x8a59, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2siERJLUo.mkv", cAlternateFileName="2SIERJ~1.MKV")) returned 0 [0249.915] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0249.915] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2siERJLUo.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2sierjluo.mkv")) returned 1 [0249.917] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2siERJLUo.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2sierjluo.mkv")) returned 0xffffffff [0249.917] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4846d1f0, ftCreationTime.dwHighDateTime=0x1d822b7, ftLastAccessTime.dwLowDateTime=0x1c0a42e0, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x1c0a42e0, ftLastWriteTime.dwHighDateTime=0x1d825c1, nFileSizeHigh=0x0, nFileSizeLow=0x3089, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="2t0jA1.mkv", cAlternateFileName="")) returned 1 [0249.917] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2t0jA1.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2t0ja1.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0249.917] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2t0jA1.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2t0ja1.mkv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0249.918] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3089 [0249.918] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0249.919] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0249.979] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3089, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x3089, lpOverlapped=0x0) returned 1 [0249.981] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x3090, lpOverlapped=0x0) returned 1 [0249.986] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.051] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.097] CloseHandle (hObject=0xf8) returned 1 [0250.097] CloseHandle (hObject=0xec) returned 1 [0250.100] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2t0jA1.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2t0ja1.mkv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2t0jA1.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2t0ja1.mkv.ozq0")) returned 0 [0250.101] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2t0jA1.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2t0ja1.mkv.ozq0")) returned 0x2020 [0250.102] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2t0jA1.mkv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4846d1f0, ftCreationTime.dwHighDateTime=0x1d822b7, ftLastAccessTime.dwLowDateTime=0x1c0a42e0, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x1c0a42e0, ftLastWriteTime.dwHighDateTime=0x1d825c1, nFileSizeHigh=0x0, nFileSizeLow=0x3089, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="2t0jA1.mkv", cAlternateFileName="")) returned 0x274de0 [0250.102] FindNextFileA (in: hFindFile=0x274de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4846d1f0, ftCreationTime.dwHighDateTime=0x1d822b7, ftLastAccessTime.dwLowDateTime=0x1c0a42e0, ftLastAccessTime.dwHighDateTime=0x1d825c1, ftLastWriteTime.dwLowDateTime=0x1c0a42e0, ftLastWriteTime.dwHighDateTime=0x1d825c1, nFileSizeHigh=0x0, nFileSizeLow=0x3089, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="2t0jA1.mkv", cAlternateFileName="")) returned 0 [0250.102] FindClose (in: hFindFile=0x274de0 | out: hFindFile=0x274de0) returned 1 [0250.102] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2t0jA1.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2t0ja1.mkv")) returned 1 [0250.103] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\2t0jA1.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\2t0ja1.mkv")) returned 0xffffffff [0250.104] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4745ed0, ftCreationTime.dwHighDateTime=0x1d82466, ftLastAccessTime.dwLowDateTime=0x47493d20, ftLastAccessTime.dwHighDateTime=0x1d8290f, ftLastWriteTime.dwLowDateTime=0x47493d20, ftLastWriteTime.dwHighDateTime=0x1d8290f, nFileSizeHigh=0x0, nFileSizeLow=0x1598c, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="4r4b7ut.png", cAlternateFileName="")) returned 1 [0250.107] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\4r4b7ut.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\4r4b7ut.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.107] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\4r4b7ut.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\4r4b7ut.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.109] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1598c [0250.109] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0250.109] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0250.161] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1598c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1598c, lpOverlapped=0x0) returned 1 [0250.163] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x15990, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x15990, lpOverlapped=0x0) returned 1 [0250.165] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.237] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.249] CloseHandle (hObject=0xec) returned 1 [0250.249] CloseHandle (hObject=0xf8) returned 1 [0250.250] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\4r4b7ut.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\4r4b7ut.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\4r4b7ut.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\4r4b7ut.png.ozq0")) returned 0 [0250.250] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\4r4b7ut.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\4r4b7ut.png.ozq0")) returned 0x2020 [0250.250] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\4r4b7ut.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4745ed0, ftCreationTime.dwHighDateTime=0x1d82466, ftLastAccessTime.dwLowDateTime=0x47493d20, ftLastAccessTime.dwHighDateTime=0x1d8290f, ftLastWriteTime.dwLowDateTime=0x47493d20, ftLastWriteTime.dwHighDateTime=0x1d8290f, nFileSizeHigh=0x0, nFileSizeLow=0x1598c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="4r4b7ut.png", cAlternateFileName="")) returned 0x275de0 [0250.250] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4745ed0, ftCreationTime.dwHighDateTime=0x1d82466, ftLastAccessTime.dwLowDateTime=0x47493d20, ftLastAccessTime.dwHighDateTime=0x1d8290f, ftLastWriteTime.dwLowDateTime=0x47493d20, ftLastWriteTime.dwHighDateTime=0x1d8290f, nFileSizeHigh=0x0, nFileSizeLow=0x1598c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="4r4b7ut.png", cAlternateFileName="")) returned 0 [0250.251] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0250.251] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\4r4b7ut.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\4r4b7ut.png")) returned 1 [0250.252] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\4r4b7ut.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\4r4b7ut.png")) returned 0xffffffff [0250.252] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75831320, ftCreationTime.dwHighDateTime=0x1d827c3, ftLastAccessTime.dwLowDateTime=0x8837a680, ftLastAccessTime.dwHighDateTime=0x1d82984, ftLastWriteTime.dwLowDateTime=0x8837a680, ftLastWriteTime.dwHighDateTime=0x1d82984, nFileSizeHigh=0x0, nFileSizeLow=0x7806, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="7eGnN5.bmp", cAlternateFileName="")) returned 1 [0250.253] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\7eGnN5.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\7egnn5.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.253] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\7eGnN5.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\7egnn5.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.254] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7806 [0250.254] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0250.254] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0250.301] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7806, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x7806, lpOverlapped=0x0) returned 1 [0250.302] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7810, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x7810, lpOverlapped=0x0) returned 1 [0250.303] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.369] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.382] CloseHandle (hObject=0xf8) returned 1 [0250.382] CloseHandle (hObject=0xec) returned 1 [0250.382] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\7eGnN5.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\7egnn5.bmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\7eGnN5.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\7egnn5.bmp.ozq0")) returned 0 [0250.382] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\7eGnN5.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\7egnn5.bmp.ozq0")) returned 0x2020 [0250.383] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\7eGnN5.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75831320, ftCreationTime.dwHighDateTime=0x1d827c3, ftLastAccessTime.dwLowDateTime=0x8837a680, ftLastAccessTime.dwHighDateTime=0x1d82984, ftLastWriteTime.dwLowDateTime=0x8837a680, ftLastWriteTime.dwHighDateTime=0x1d82984, nFileSizeHigh=0x0, nFileSizeLow=0x7806, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="7eGnN5.bmp", cAlternateFileName="")) returned 0x275de0 [0250.383] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x75831320, ftCreationTime.dwHighDateTime=0x1d827c3, ftLastAccessTime.dwLowDateTime=0x8837a680, ftLastAccessTime.dwHighDateTime=0x1d82984, ftLastWriteTime.dwLowDateTime=0x8837a680, ftLastWriteTime.dwHighDateTime=0x1d82984, nFileSizeHigh=0x0, nFileSizeLow=0x7806, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="7eGnN5.bmp", cAlternateFileName="")) returned 0 [0250.383] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0250.383] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\7eGnN5.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\7egnn5.bmp")) returned 1 [0250.384] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\7eGnN5.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\7egnn5.bmp")) returned 0xffffffff [0250.384] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14ca5c0, ftCreationTime.dwHighDateTime=0x1d828bd, ftLastAccessTime.dwLowDateTime=0x564cbd30, ftLastAccessTime.dwHighDateTime=0x1d82a11, ftLastWriteTime.dwLowDateTime=0x564cbd30, ftLastWriteTime.dwHighDateTime=0x1d82a11, nFileSizeHigh=0x0, nFileSizeLow=0x18eb0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="8M5GOPo0uI6oCy9aNPnN.avi", cAlternateFileName="8M5GOP~1.AVI")) returned 1 [0250.384] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\8M5GOPo0uI6oCy9aNPnN.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\8m5gopo0ui6ocy9anpnn.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.385] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\8M5GOPo0uI6oCy9aNPnN.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\8m5gopo0ui6ocy9anpnn.avi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.385] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18eb0 [0250.385] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0250.386] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0250.435] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18eb0, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x18eb0, lpOverlapped=0x0) returned 1 [0250.438] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x18ec0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x18ec0, lpOverlapped=0x0) returned 1 [0250.440] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.507] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.522] CloseHandle (hObject=0xec) returned 1 [0250.522] CloseHandle (hObject=0xf8) returned 1 [0250.522] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\8M5GOPo0uI6oCy9aNPnN.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\8m5gopo0ui6ocy9anpnn.avi"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\8M5GOPo0uI6oCy9aNPnN.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\8m5gopo0ui6ocy9anpnn.avi.ozq0")) returned 0 [0250.523] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\8M5GOPo0uI6oCy9aNPnN.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\8m5gopo0ui6ocy9anpnn.avi.ozq0")) returned 0x2020 [0250.523] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\8M5GOPo0uI6oCy9aNPnN.avi", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14ca5c0, ftCreationTime.dwHighDateTime=0x1d828bd, ftLastAccessTime.dwLowDateTime=0x564cbd30, ftLastAccessTime.dwHighDateTime=0x1d82a11, ftLastWriteTime.dwLowDateTime=0x564cbd30, ftLastWriteTime.dwHighDateTime=0x1d82a11, nFileSizeHigh=0x0, nFileSizeLow=0x18eb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="8M5GOPo0uI6oCy9aNPnN.avi", cAlternateFileName="8M5GOP~1.AVI")) returned 0x26dd48 [0250.523] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x14ca5c0, ftCreationTime.dwHighDateTime=0x1d828bd, ftLastAccessTime.dwLowDateTime=0x564cbd30, ftLastAccessTime.dwHighDateTime=0x1d82a11, ftLastWriteTime.dwLowDateTime=0x564cbd30, ftLastWriteTime.dwHighDateTime=0x1d82a11, nFileSizeHigh=0x0, nFileSizeLow=0x18eb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="8M5GOPo0uI6oCy9aNPnN.avi", cAlternateFileName="8M5GOP~1.AVI")) returned 0 [0250.523] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0250.523] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\8M5GOPo0uI6oCy9aNPnN.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\8m5gopo0ui6ocy9anpnn.avi")) returned 1 [0250.525] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\8M5GOPo0uI6oCy9aNPnN.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\8m5gopo0ui6ocy9anpnn.avi")) returned 0xffffffff [0250.525] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb001c80, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xdf36cf50, ftLastAccessTime.dwHighDateTime=0x1d82714, ftLastWriteTime.dwLowDateTime=0xdf36cf50, ftLastWriteTime.dwHighDateTime=0x1d82714, nFileSizeHigh=0x0, nFileSizeLow=0x12899, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="9sO-MPKfwXqV6BS.avi", cAlternateFileName="9SO-MP~1.AVI")) returned 1 [0250.526] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\9sO-MPKfwXqV6BS.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\9so-mpkfwxqv6bs.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.526] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\9sO-MPKfwXqV6BS.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\9so-mpkfwxqv6bs.avi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.527] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12899 [0250.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0250.528] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0250.584] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12899, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x12899, lpOverlapped=0x0) returned 1 [0250.586] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x128a0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x128a0, lpOverlapped=0x0) returned 1 [0250.588] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.646] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.659] CloseHandle (hObject=0xf8) returned 1 [0250.659] CloseHandle (hObject=0xec) returned 1 [0250.659] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\9sO-MPKfwXqV6BS.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\9so-mpkfwxqv6bs.avi"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\9sO-MPKfwXqV6BS.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\9so-mpkfwxqv6bs.avi.ozq0")) returned 0 [0250.660] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\9sO-MPKfwXqV6BS.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\9so-mpkfwxqv6bs.avi.ozq0")) returned 0x2020 [0250.660] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\9sO-MPKfwXqV6BS.avi", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb001c80, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xdf36cf50, ftLastAccessTime.dwHighDateTime=0x1d82714, ftLastWriteTime.dwLowDateTime=0xdf36cf50, ftLastWriteTime.dwHighDateTime=0x1d82714, nFileSizeHigh=0x0, nFileSizeLow=0x12899, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="9sO-MPKfwXqV6BS.avi", cAlternateFileName="9SO-MP~1.AVI")) returned 0x26dd48 [0250.660] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbb001c80, ftCreationTime.dwHighDateTime=0x1d824ef, ftLastAccessTime.dwLowDateTime=0xdf36cf50, ftLastAccessTime.dwHighDateTime=0x1d82714, ftLastWriteTime.dwLowDateTime=0xdf36cf50, ftLastWriteTime.dwHighDateTime=0x1d82714, nFileSizeHigh=0x0, nFileSizeLow=0x12899, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="9sO-MPKfwXqV6BS.avi", cAlternateFileName="9SO-MP~1.AVI")) returned 0 [0250.660] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0250.660] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\9sO-MPKfwXqV6BS.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\9so-mpkfwxqv6bs.avi")) returned 1 [0250.662] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\9sO-MPKfwXqV6BS.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\9so-mpkfwxqv6bs.avi")) returned 0xffffffff [0250.662] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5fe81af0, ftCreationTime.dwHighDateTime=0x1d8286e, ftLastAccessTime.dwLowDateTime=0xf94e99a0, ftLastAccessTime.dwHighDateTime=0x1d82975, ftLastWriteTime.dwLowDateTime=0xf94e99a0, ftLastWriteTime.dwHighDateTime=0x1d82975, nFileSizeHigh=0x0, nFileSizeLow=0x92b, dwReserved0=0x0, dwReserved1=0x0, cFileName="a7U PBcdeNdYg.mkv", cAlternateFileName="A7UPBC~1.MKV")) returned 1 [0250.662] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\a7U PBcdeNdYg.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\a7u pbcdendyg.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.662] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\a7U PBcdeNdYg.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\a7u pbcdendyg.mkv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.663] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x92b [0250.663] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0250.663] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0250.708] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x92b, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x92b, lpOverlapped=0x0) returned 1 [0250.709] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x930, lpOverlapped=0x0) returned 1 [0250.718] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.778] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.791] CloseHandle (hObject=0xec) returned 1 [0250.791] CloseHandle (hObject=0xf8) returned 1 [0250.792] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\a7U PBcdeNdYg.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\a7u pbcdendyg.mkv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\a7U PBcdeNdYg.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\a7u pbcdendyg.mkv.ozq0")) returned 0 [0250.793] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\a7U PBcdeNdYg.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\a7u pbcdendyg.mkv.ozq0")) returned 0x2020 [0250.793] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\a7U PBcdeNdYg.mkv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5fe81af0, ftCreationTime.dwHighDateTime=0x1d8286e, ftLastAccessTime.dwLowDateTime=0xf94e99a0, ftLastAccessTime.dwHighDateTime=0x1d82975, ftLastWriteTime.dwLowDateTime=0xf94e99a0, ftLastWriteTime.dwHighDateTime=0x1d82975, nFileSizeHigh=0x0, nFileSizeLow=0x92b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="a7U PBcdeNdYg.mkv", cAlternateFileName="A7UPBC~1.MKV")) returned 0x26dd48 [0250.793] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5fe81af0, ftCreationTime.dwHighDateTime=0x1d8286e, ftLastAccessTime.dwLowDateTime=0xf94e99a0, ftLastAccessTime.dwHighDateTime=0x1d82975, ftLastWriteTime.dwLowDateTime=0xf94e99a0, ftLastWriteTime.dwHighDateTime=0x1d82975, nFileSizeHigh=0x0, nFileSizeLow=0x92b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="a7U PBcdeNdYg.mkv", cAlternateFileName="A7UPBC~1.MKV")) returned 0 [0250.793] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0250.793] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\a7U PBcdeNdYg.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\a7u pbcdendyg.mkv")) returned 1 [0250.794] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\a7U PBcdeNdYg.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\a7u pbcdendyg.mkv")) returned 0xffffffff [0250.794] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc34b1420, ftCreationTime.dwHighDateTime=0x1d8267b, ftLastAccessTime.dwLowDateTime=0xc85e1710, ftLastAccessTime.dwHighDateTime=0x1d82a1c, ftLastWriteTime.dwLowDateTime=0xc85e1710, ftLastWriteTime.dwHighDateTime=0x1d82a1c, nFileSizeHigh=0x0, nFileSizeLow=0x782f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AAfoi.bmp", cAlternateFileName="")) returned 1 [0250.795] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AAfoi.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\aafoi.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.795] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AAfoi.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\aafoi.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.796] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x782f [0250.796] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0250.796] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0250.840] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x782f, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x782f, lpOverlapped=0x0) returned 1 [0250.842] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7830, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x7830, lpOverlapped=0x0) returned 1 [0250.843] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0250.924] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0250.936] CloseHandle (hObject=0xf8) returned 1 [0250.936] CloseHandle (hObject=0xec) returned 1 [0250.936] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AAfoi.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\aafoi.bmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AAfoi.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\aafoi.bmp.ozq0")) returned 0 [0250.936] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AAfoi.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\aafoi.bmp.ozq0")) returned 0x2020 [0250.937] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AAfoi.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc34b1420, ftCreationTime.dwHighDateTime=0x1d8267b, ftLastAccessTime.dwLowDateTime=0xc85e1710, ftLastAccessTime.dwHighDateTime=0x1d82a1c, ftLastWriteTime.dwLowDateTime=0xc85e1710, ftLastWriteTime.dwHighDateTime=0x1d82a1c, nFileSizeHigh=0x0, nFileSizeLow=0x782f, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="AAfoi.bmp", cAlternateFileName="")) returned 0x275de0 [0250.937] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc34b1420, ftCreationTime.dwHighDateTime=0x1d8267b, ftLastAccessTime.dwLowDateTime=0xc85e1710, ftLastAccessTime.dwHighDateTime=0x1d82a1c, ftLastWriteTime.dwLowDateTime=0xc85e1710, ftLastWriteTime.dwHighDateTime=0x1d82a1c, nFileSizeHigh=0x0, nFileSizeLow=0x782f, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="AAfoi.bmp", cAlternateFileName="")) returned 0 [0250.937] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0250.937] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AAfoi.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\aafoi.bmp")) returned 1 [0250.938] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\AAfoi.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\aafoi.bmp")) returned 0xffffffff [0250.938] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7175310, ftCreationTime.dwHighDateTime=0x1d8212b, ftLastAccessTime.dwLowDateTime=0x1449c160, ftLastAccessTime.dwHighDateTime=0x1d8257c, ftLastWriteTime.dwLowDateTime=0x1449c160, ftLastWriteTime.dwHighDateTime=0x1d8257c, nFileSizeHigh=0x0, nFileSizeLow=0x18984, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="bmElx5PLQsk.png", cAlternateFileName="BMELX5~1.PNG")) returned 1 [0250.938] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\bmElx5PLQsk.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bmelx5plqsk.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0250.939] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\bmElx5PLQsk.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bmelx5plqsk.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0250.939] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18984 [0250.940] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0250.940] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0250.988] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18984, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x18984, lpOverlapped=0x0) returned 1 [0250.990] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x18990, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x18990, lpOverlapped=0x0) returned 1 [0250.992] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.056] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.068] CloseHandle (hObject=0xec) returned 1 [0251.068] CloseHandle (hObject=0xf8) returned 1 [0251.068] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\bmElx5PLQsk.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bmelx5plqsk.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\bmElx5PLQsk.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bmelx5plqsk.png.ozq0")) returned 0 [0251.069] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\bmElx5PLQsk.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bmelx5plqsk.png.ozq0")) returned 0x2020 [0251.069] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\bmElx5PLQsk.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7175310, ftCreationTime.dwHighDateTime=0x1d8212b, ftLastAccessTime.dwLowDateTime=0x1449c160, ftLastAccessTime.dwHighDateTime=0x1d8257c, ftLastWriteTime.dwLowDateTime=0x1449c160, ftLastWriteTime.dwHighDateTime=0x1d8257c, nFileSizeHigh=0x0, nFileSizeLow=0x18984, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="bmElx5PLQsk.png", cAlternateFileName="BMELX5~1.PNG")) returned 0x26dd48 [0251.069] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7175310, ftCreationTime.dwHighDateTime=0x1d8212b, ftLastAccessTime.dwLowDateTime=0x1449c160, ftLastAccessTime.dwHighDateTime=0x1d8257c, ftLastWriteTime.dwLowDateTime=0x1449c160, ftLastWriteTime.dwHighDateTime=0x1d8257c, nFileSizeHigh=0x0, nFileSizeLow=0x18984, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="bmElx5PLQsk.png", cAlternateFileName="BMELX5~1.PNG")) returned 0 [0251.069] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0251.069] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\bmElx5PLQsk.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bmelx5plqsk.png")) returned 1 [0251.071] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\bmElx5PLQsk.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\bmelx5plqsk.png")) returned 0xffffffff [0251.071] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdeac7bd0, ftCreationTime.dwHighDateTime=0x1d81a3e, ftLastAccessTime.dwLowDateTime=0x9a51c680, ftLastAccessTime.dwHighDateTime=0x1d820f0, ftLastWriteTime.dwLowDateTime=0x9a51c680, ftLastWriteTime.dwHighDateTime=0x1d820f0, nFileSizeHigh=0x0, nFileSizeLow=0xfb37, dwReserved0=0x0, dwReserved1=0x0, cFileName="D9ZD7EKP.pptx", cAlternateFileName="D9ZD7E~1.PPT")) returned 1 [0251.071] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\D9ZD7EKP.pptx" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\d9zd7ekp.pptx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.071] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\D9ZD7EKP.pptx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\d9zd7ekp.pptx.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0251.072] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xfb37 [0251.072] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0251.072] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0251.128] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xfb37, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xfb37, lpOverlapped=0x0) returned 1 [0251.129] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xfb40, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xfb40, lpOverlapped=0x0) returned 1 [0251.131] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.195] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.207] CloseHandle (hObject=0xf8) returned 1 [0251.207] CloseHandle (hObject=0xec) returned 1 [0251.208] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\D9ZD7EKP.pptx" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\d9zd7ekp.pptx"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\D9ZD7EKP.pptx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\d9zd7ekp.pptx.ozq0")) returned 0 [0251.208] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\D9ZD7EKP.pptx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\d9zd7ekp.pptx.ozq0")) returned 0x2020 [0251.209] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\D9ZD7EKP.pptx", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdeac7bd0, ftCreationTime.dwHighDateTime=0x1d81a3e, ftLastAccessTime.dwLowDateTime=0x9a51c680, ftLastAccessTime.dwHighDateTime=0x1d820f0, ftLastWriteTime.dwLowDateTime=0x9a51c680, ftLastWriteTime.dwHighDateTime=0x1d820f0, nFileSizeHigh=0x0, nFileSizeLow=0xfb37, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="D9ZD7EKP.pptx", cAlternateFileName="D9ZD7E~1.PPT")) returned 0x275de0 [0251.209] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdeac7bd0, ftCreationTime.dwHighDateTime=0x1d81a3e, ftLastAccessTime.dwLowDateTime=0x9a51c680, ftLastAccessTime.dwHighDateTime=0x1d820f0, ftLastWriteTime.dwLowDateTime=0x9a51c680, ftLastWriteTime.dwHighDateTime=0x1d820f0, nFileSizeHigh=0x0, nFileSizeLow=0xfb37, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="D9ZD7EKP.pptx", cAlternateFileName="D9ZD7E~1.PPT")) returned 0 [0251.209] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0251.209] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\D9ZD7EKP.pptx" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\d9zd7ekp.pptx")) returned 1 [0251.210] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\D9ZD7EKP.pptx" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\d9zd7ekp.pptx")) returned 0xffffffff [0251.210] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadb74d70, ftCreationTime.dwHighDateTime=0x1d824ed, ftLastAccessTime.dwLowDateTime=0x55de8370, ftLastAccessTime.dwHighDateTime=0x1d8288f, ftLastWriteTime.dwLowDateTime=0x55de8370, ftLastWriteTime.dwHighDateTime=0x1d8288f, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="DrjIX8ZI.mp3", cAlternateFileName="")) returned 1 [0251.211] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\DrjIX8ZI.mp3" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\drjix8zi.mp3"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0251.211] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\DrjIX8ZI.mp3.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\drjix8zi.mp3.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.212] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17b9 [0251.212] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0251.213] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0251.258] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x17b9, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x17b9, lpOverlapped=0x0) returned 1 [0251.259] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x17c0, lpOverlapped=0x0) returned 1 [0251.260] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.318] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.330] CloseHandle (hObject=0xec) returned 1 [0251.330] CloseHandle (hObject=0xf8) returned 1 [0251.330] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\DrjIX8ZI.mp3" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\drjix8zi.mp3"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\DrjIX8ZI.mp3.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\drjix8zi.mp3.ozq0")) returned 0 [0251.330] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\DrjIX8ZI.mp3.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\drjix8zi.mp3.ozq0")) returned 0x2020 [0251.331] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\DrjIX8ZI.mp3", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadb74d70, ftCreationTime.dwHighDateTime=0x1d824ed, ftLastAccessTime.dwLowDateTime=0x55de8370, ftLastAccessTime.dwHighDateTime=0x1d8288f, ftLastWriteTime.dwLowDateTime=0x55de8370, ftLastWriteTime.dwHighDateTime=0x1d8288f, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="DrjIX8ZI.mp3", cAlternateFileName="")) returned 0x275de0 [0251.331] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xadb74d70, ftCreationTime.dwHighDateTime=0x1d824ed, ftLastAccessTime.dwLowDateTime=0x55de8370, ftLastAccessTime.dwHighDateTime=0x1d8288f, ftLastWriteTime.dwLowDateTime=0x55de8370, ftLastWriteTime.dwHighDateTime=0x1d8288f, nFileSizeHigh=0x0, nFileSizeLow=0x17b9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="DrjIX8ZI.mp3", cAlternateFileName="")) returned 0 [0251.331] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0251.331] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\DrjIX8ZI.mp3" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\drjix8zi.mp3")) returned 1 [0251.332] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\DrjIX8ZI.mp3" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\drjix8zi.mp3")) returned 0xffffffff [0251.332] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b5c3cf0, ftCreationTime.dwHighDateTime=0x1d81a32, ftLastAccessTime.dwLowDateTime=0xac162ac0, ftLastAccessTime.dwHighDateTime=0x1d81d51, ftLastWriteTime.dwLowDateTime=0xac162ac0, ftLastWriteTime.dwHighDateTime=0x1d81d51, nFileSizeHigh=0x0, nFileSizeLow=0x663b, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="EZV0aJou.flv", cAlternateFileName="")) returned 1 [0251.332] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\EZV0aJou.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ezv0ajou.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.332] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\EZV0aJou.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ezv0ajou.flv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0251.333] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x663b [0251.333] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0251.334] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0251.391] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x663b, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x663b, lpOverlapped=0x0) returned 1 [0251.392] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x6640, lpOverlapped=0x0) returned 1 [0251.394] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.454] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.466] CloseHandle (hObject=0xf8) returned 1 [0251.466] CloseHandle (hObject=0xec) returned 1 [0251.466] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\EZV0aJou.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ezv0ajou.flv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\EZV0aJou.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ezv0ajou.flv.ozq0")) returned 0 [0251.467] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\EZV0aJou.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ezv0ajou.flv.ozq0")) returned 0x2020 [0251.467] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\EZV0aJou.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b5c3cf0, ftCreationTime.dwHighDateTime=0x1d81a32, ftLastAccessTime.dwLowDateTime=0xac162ac0, ftLastAccessTime.dwHighDateTime=0x1d81d51, ftLastWriteTime.dwLowDateTime=0xac162ac0, ftLastWriteTime.dwHighDateTime=0x1d81d51, nFileSizeHigh=0x0, nFileSizeLow=0x663b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="EZV0aJou.flv", cAlternateFileName="")) returned 0x275de0 [0251.467] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b5c3cf0, ftCreationTime.dwHighDateTime=0x1d81a32, ftLastAccessTime.dwLowDateTime=0xac162ac0, ftLastAccessTime.dwHighDateTime=0x1d81d51, ftLastWriteTime.dwLowDateTime=0xac162ac0, ftLastWriteTime.dwHighDateTime=0x1d81d51, nFileSizeHigh=0x0, nFileSizeLow=0x663b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="EZV0aJou.flv", cAlternateFileName="")) returned 0 [0251.467] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0251.467] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\EZV0aJou.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ezv0ajou.flv")) returned 1 [0251.468] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\EZV0aJou.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ezv0ajou.flv")) returned 0xffffffff [0251.468] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x904a1680, ftCreationTime.dwHighDateTime=0x1d82832, ftLastAccessTime.dwLowDateTime=0xd4e0f00, ftLastAccessTime.dwHighDateTime=0x1d82933, ftLastWriteTime.dwLowDateTime=0xd4e0f00, ftLastWriteTime.dwHighDateTime=0x1d82933, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="F0h rew8F1N_SIrv.png", cAlternateFileName="F0HREW~1.PNG")) returned 1 [0251.468] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\F0h rew8F1N_SIrv.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\f0h rew8f1n_sirv.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0251.469] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\F0h rew8F1N_SIrv.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\f0h rew8f1n_sirv.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.470] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17e2d [0251.470] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0251.470] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0251.514] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x17e2d, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x17e2d, lpOverlapped=0x0) returned 1 [0251.516] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17e30, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x17e30, lpOverlapped=0x0) returned 1 [0251.519] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.583] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.595] CloseHandle (hObject=0xec) returned 1 [0251.595] CloseHandle (hObject=0xf8) returned 1 [0251.595] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\F0h rew8F1N_SIrv.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\f0h rew8f1n_sirv.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\F0h rew8F1N_SIrv.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\f0h rew8f1n_sirv.png.ozq0")) returned 0 [0251.596] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\F0h rew8F1N_SIrv.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\f0h rew8f1n_sirv.png.ozq0")) returned 0x2020 [0251.596] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\F0h rew8F1N_SIrv.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x904a1680, ftCreationTime.dwHighDateTime=0x1d82832, ftLastAccessTime.dwLowDateTime=0xd4e0f00, ftLastAccessTime.dwHighDateTime=0x1d82933, ftLastWriteTime.dwLowDateTime=0xd4e0f00, ftLastWriteTime.dwHighDateTime=0x1d82933, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="F0h rew8F1N_SIrv.png", cAlternateFileName="F0HREW~1.PNG")) returned 0x26dd48 [0251.596] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x904a1680, ftCreationTime.dwHighDateTime=0x1d82832, ftLastAccessTime.dwLowDateTime=0xd4e0f00, ftLastAccessTime.dwHighDateTime=0x1d82933, ftLastWriteTime.dwLowDateTime=0xd4e0f00, ftLastWriteTime.dwHighDateTime=0x1d82933, nFileSizeHigh=0x0, nFileSizeLow=0x17e2d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="F0h rew8F1N_SIrv.png", cAlternateFileName="F0HREW~1.PNG")) returned 0 [0251.596] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0251.596] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\F0h rew8F1N_SIrv.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\f0h rew8f1n_sirv.png")) returned 1 [0251.598] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\F0h rew8F1N_SIrv.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\f0h rew8f1n_sirv.png")) returned 0xffffffff [0251.598] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x852aa500, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x852aa500, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1 [0251.598] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0251.599] CloseHandle (hObject=0xffffffff) returned 0 [0251.599] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\fxsapidebuglogfile.txt.ozq0")) returned 0 [0251.599] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\fxsapidebuglogfile.txt.ozq0")) returned 0xffffffff [0251.599] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x852aa500, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x852aa500, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0x26dd48 [0251.599] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x852aa500, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x852aa500, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 0 [0251.599] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0251.599] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0 [0251.599] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\fxsapidebuglogfile.txt")) returned 0x2020 [0251.599] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="gen_py", cAlternateFileName="")) returned 1 [0251.599] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a0078, dwReserved1=0x275de0, cFileName=".", cAlternateFileName="")) returned 0x275de0 [0251.600] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a0078, dwReserved1=0x275de0, cFileName="..", cAlternateFileName="")) returned 1 [0251.600] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a0078, dwReserved1=0x275de0, cFileName="3.8", cAlternateFileName="")) returned 1 [0251.600] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250074, dwReserved1=0x279fe0, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0251.600] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250074, dwReserved1=0x279fe0, cFileName="..", cAlternateFileName="")) returned 1 [0251.600] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x250074, dwReserved1=0x279fe0, cFileName="dicts.dat", cAlternateFileName="")) returned 1 [0251.600] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\dicts.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\dicts.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0251.600] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\dicts.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\dicts.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0251.601] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa [0251.601] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0251.601] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0251.666] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xa, lpOverlapped=0x0) returned 1 [0251.667] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x10, lpOverlapped=0x0) returned 1 [0251.668] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.728] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.755] CloseHandle (hObject=0xe8) returned 1 [0251.755] CloseHandle (hObject=0xe0) returned 1 [0251.755] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\dicts.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\dicts.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\dicts.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\dicts.dat.ozq0")) returned 0 [0251.757] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\dicts.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\dicts.dat.ozq0")) returned 0x2020 [0251.757] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\dicts.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="dicts.dat", cAlternateFileName="")) returned 0x26dd88 [0251.757] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="dicts.dat", cAlternateFileName="")) returned 0 [0251.757] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0251.758] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\dicts.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\dicts.dat")) returned 1 [0251.759] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\dicts.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\dicts.dat")) returned 0xffffffff [0251.759] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="__init__.py", cAlternateFileName="")) returned 1 [0251.759] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\__init__.py" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\__init__.py"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0251.760] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\__init__.py.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\__init__.py.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0251.761] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb0 [0251.761] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0251.761] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0251.814] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xb0, lpOverlapped=0x0) returned 1 [0251.815] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xc0, lpOverlapped=0x0) returned 1 [0251.816] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0251.873] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0251.884] CloseHandle (hObject=0xe0) returned 1 [0251.885] CloseHandle (hObject=0xe8) returned 1 [0251.885] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\__init__.py" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\__init__.py"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\__init__.py.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\__init__.py.ozq0")) returned 0 [0251.885] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\__init__.py.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\__init__.py.ozq0")) returned 0x2020 [0251.886] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\__init__.py", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="__init__.py", cAlternateFileName="")) returned 0x26dd88 [0251.886] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="__init__.py", cAlternateFileName="")) returned 0 [0251.886] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0251.887] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\__init__.py" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\__init__.py")) returned 1 [0251.888] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\gen_py\\3.8\\__init__.py" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\gen_py\\3.8\\__init__.py")) returned 0xffffffff [0251.888] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="__init__.py", cAlternateFileName="")) returned 0 [0251.889] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0251.889] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x5781e5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5781e5c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5781e5c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7a0078, dwReserved1=0x275de0, cFileName="3.8", cAlternateFileName="")) returned 0 [0251.889] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0251.889] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9033b0, ftCreationTime.dwHighDateTime=0x1d82336, ftLastAccessTime.dwLowDateTime=0x74de69e0, ftLastAccessTime.dwHighDateTime=0x1d825ae, ftLastWriteTime.dwLowDateTime=0x74de69e0, ftLastWriteTime.dwHighDateTime=0x1d825ae, nFileSizeHigh=0x0, nFileSizeLow=0x5f6d, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="hM8rX5Y6.odp", cAlternateFileName="")) returned 1 [0251.889] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\hM8rX5Y6.odp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\hm8rx5y6.odp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0251.889] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\hM8rX5Y6.odp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\hm8rx5y6.odp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0251.890] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5f6d [0251.891] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0251.891] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0251.958] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5f6d, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x5f6d, lpOverlapped=0x0) returned 1 [0251.959] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x5f70, lpOverlapped=0x0) returned 1 [0251.961] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.018] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.030] CloseHandle (hObject=0xf8) returned 1 [0252.030] CloseHandle (hObject=0xec) returned 1 [0252.031] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\hM8rX5Y6.odp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\hm8rx5y6.odp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\hM8rX5Y6.odp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\hm8rx5y6.odp.ozq0")) returned 0 [0252.031] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\hM8rX5Y6.odp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\hm8rx5y6.odp.ozq0")) returned 0x2020 [0252.032] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\hM8rX5Y6.odp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9033b0, ftCreationTime.dwHighDateTime=0x1d82336, ftLastAccessTime.dwLowDateTime=0x74de69e0, ftLastAccessTime.dwHighDateTime=0x1d825ae, ftLastWriteTime.dwLowDateTime=0x74de69e0, ftLastWriteTime.dwHighDateTime=0x1d825ae, nFileSizeHigh=0x0, nFileSizeLow=0x5f6d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="hM8rX5Y6.odp", cAlternateFileName="")) returned 0x275de0 [0252.032] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9033b0, ftCreationTime.dwHighDateTime=0x1d82336, ftLastAccessTime.dwLowDateTime=0x74de69e0, ftLastAccessTime.dwHighDateTime=0x1d825ae, ftLastWriteTime.dwLowDateTime=0x74de69e0, ftLastWriteTime.dwHighDateTime=0x1d825ae, nFileSizeHigh=0x0, nFileSizeLow=0x5f6d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="hM8rX5Y6.odp", cAlternateFileName="")) returned 0 [0252.032] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0252.032] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\hM8rX5Y6.odp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\hm8rx5y6.odp")) returned 1 [0252.033] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\hM8rX5Y6.odp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\hm8rx5y6.odp")) returned 0xffffffff [0252.033] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x71b61b90, ftCreationTime.dwHighDateTime=0x1d82942, ftLastAccessTime.dwLowDateTime=0x2040e0d0, ftLastAccessTime.dwHighDateTime=0x1d82968, ftLastWriteTime.dwLowDateTime=0x2040e0d0, ftLastWriteTime.dwHighDateTime=0x1d82968, nFileSizeHigh=0x0, nFileSizeLow=0x1182, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="iC5Gd.mp4", cAlternateFileName="")) returned 1 [0252.033] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\iC5Gd.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ic5gd.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.034] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\iC5Gd.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ic5gd.mp4.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0252.034] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1182 [0252.034] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0252.035] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0252.081] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1182, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1182, lpOverlapped=0x0) returned 1 [0252.081] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1190, lpOverlapped=0x0) returned 1 [0252.083] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.140] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.152] CloseHandle (hObject=0xec) returned 1 [0252.152] CloseHandle (hObject=0xf8) returned 1 [0252.153] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\iC5Gd.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ic5gd.mp4"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\iC5Gd.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ic5gd.mp4.ozq0")) returned 0 [0252.153] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\iC5Gd.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ic5gd.mp4.ozq0")) returned 0x2020 [0252.153] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\iC5Gd.mp4", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x71b61b90, ftCreationTime.dwHighDateTime=0x1d82942, ftLastAccessTime.dwLowDateTime=0x2040e0d0, ftLastAccessTime.dwHighDateTime=0x1d82968, ftLastWriteTime.dwLowDateTime=0x2040e0d0, ftLastWriteTime.dwHighDateTime=0x1d82968, nFileSizeHigh=0x0, nFileSizeLow=0x1182, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="iC5Gd.mp4", cAlternateFileName="")) returned 0x275de0 [0252.154] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x71b61b90, ftCreationTime.dwHighDateTime=0x1d82942, ftLastAccessTime.dwLowDateTime=0x2040e0d0, ftLastAccessTime.dwHighDateTime=0x1d82968, ftLastWriteTime.dwLowDateTime=0x2040e0d0, ftLastWriteTime.dwHighDateTime=0x1d82968, nFileSizeHigh=0x0, nFileSizeLow=0x1182, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="iC5Gd.mp4", cAlternateFileName="")) returned 0 [0252.154] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0252.154] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\iC5Gd.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ic5gd.mp4")) returned 1 [0252.155] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\iC5Gd.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ic5gd.mp4")) returned 0xffffffff [0252.155] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4c34f0, ftCreationTime.dwHighDateTime=0x1d82109, ftLastAccessTime.dwLowDateTime=0x9d284160, ftLastAccessTime.dwHighDateTime=0x1d821e8, ftLastWriteTime.dwLowDateTime=0x9d284160, ftLastWriteTime.dwHighDateTime=0x1d821e8, nFileSizeHigh=0x0, nFileSizeLow=0x3486, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="JXC Yk7wefY.bmp", cAlternateFileName="JXCYK7~1.BMP")) returned 1 [0252.155] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\JXC Yk7wefY.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\jxc yk7wefy.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0252.155] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\JXC Yk7wefY.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\jxc yk7wefy.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.156] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3486 [0252.156] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0252.156] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0252.201] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3486, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x3486, lpOverlapped=0x0) returned 1 [0252.202] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3490, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x3490, lpOverlapped=0x0) returned 1 [0252.203] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.264] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.285] CloseHandle (hObject=0xf8) returned 1 [0252.285] CloseHandle (hObject=0xec) returned 1 [0252.285] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\JXC Yk7wefY.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\jxc yk7wefy.bmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\JXC Yk7wefY.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\jxc yk7wefy.bmp.ozq0")) returned 0 [0252.285] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\JXC Yk7wefY.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\jxc yk7wefy.bmp.ozq0")) returned 0x2020 [0252.286] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\JXC Yk7wefY.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4c34f0, ftCreationTime.dwHighDateTime=0x1d82109, ftLastAccessTime.dwLowDateTime=0x9d284160, ftLastAccessTime.dwHighDateTime=0x1d821e8, ftLastWriteTime.dwLowDateTime=0x9d284160, ftLastWriteTime.dwHighDateTime=0x1d821e8, nFileSizeHigh=0x0, nFileSizeLow=0x3486, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="JXC Yk7wefY.bmp", cAlternateFileName="JXCYK7~1.BMP")) returned 0x26dd48 [0252.286] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd4c34f0, ftCreationTime.dwHighDateTime=0x1d82109, ftLastAccessTime.dwLowDateTime=0x9d284160, ftLastAccessTime.dwHighDateTime=0x1d821e8, ftLastWriteTime.dwLowDateTime=0x9d284160, ftLastWriteTime.dwHighDateTime=0x1d821e8, nFileSizeHigh=0x0, nFileSizeLow=0x3486, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="JXC Yk7wefY.bmp", cAlternateFileName="JXCYK7~1.BMP")) returned 0 [0252.286] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0252.286] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\JXC Yk7wefY.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\jxc yk7wefy.bmp")) returned 1 [0252.287] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\JXC Yk7wefY.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\jxc yk7wefy.bmp")) returned 0xffffffff [0252.287] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ad87e80, ftCreationTime.dwHighDateTime=0x1d82983, ftLastAccessTime.dwLowDateTime=0xbc9870c0, ftLastAccessTime.dwHighDateTime=0x1d829c6, ftLastWriteTime.dwLowDateTime=0xbc9870c0, ftLastWriteTime.dwHighDateTime=0x1d829c6, nFileSizeHigh=0x0, nFileSizeLow=0x18756, dwReserved0=0x0, dwReserved1=0x0, cFileName="KbQ__fvt- d9bTlu0B.flv", cAlternateFileName="KBQ__F~1.FLV")) returned 1 [0252.287] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\KbQ__fvt- d9bTlu0B.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kbq__fvt- d9btlu0b.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.288] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\KbQ__fvt- d9bTlu0B.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kbq__fvt- d9btlu0b.flv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0252.289] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18756 [0252.289] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0252.289] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0252.338] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18756, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x18756, lpOverlapped=0x0) returned 1 [0252.341] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x18760, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x18760, lpOverlapped=0x0) returned 1 [0252.343] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.404] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.416] CloseHandle (hObject=0xec) returned 1 [0252.416] CloseHandle (hObject=0xf8) returned 1 [0252.417] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\KbQ__fvt- d9bTlu0B.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kbq__fvt- d9btlu0b.flv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\KbQ__fvt- d9bTlu0B.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kbq__fvt- d9btlu0b.flv.ozq0")) returned 0 [0252.417] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\KbQ__fvt- d9bTlu0B.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kbq__fvt- d9btlu0b.flv.ozq0")) returned 0x2020 [0252.417] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\KbQ__fvt- d9bTlu0B.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ad87e80, ftCreationTime.dwHighDateTime=0x1d82983, ftLastAccessTime.dwLowDateTime=0xbc9870c0, ftLastAccessTime.dwHighDateTime=0x1d829c6, ftLastWriteTime.dwLowDateTime=0xbc9870c0, ftLastWriteTime.dwHighDateTime=0x1d829c6, nFileSizeHigh=0x0, nFileSizeLow=0x18756, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="KbQ__fvt- d9bTlu0B.flv", cAlternateFileName="KBQ__F~1.FLV")) returned 0x26dd48 [0252.418] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ad87e80, ftCreationTime.dwHighDateTime=0x1d82983, ftLastAccessTime.dwLowDateTime=0xbc9870c0, ftLastAccessTime.dwHighDateTime=0x1d829c6, ftLastWriteTime.dwLowDateTime=0xbc9870c0, ftLastWriteTime.dwHighDateTime=0x1d829c6, nFileSizeHigh=0x0, nFileSizeLow=0x18756, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="KbQ__fvt- d9bTlu0B.flv", cAlternateFileName="KBQ__F~1.FLV")) returned 0 [0252.418] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0252.418] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\KbQ__fvt- d9bTlu0B.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kbq__fvt- d9btlu0b.flv")) returned 1 [0252.419] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\KbQ__fvt- d9bTlu0B.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kbq__fvt- d9btlu0b.flv")) returned 0xffffffff [0252.419] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4ccb4d0, ftCreationTime.dwHighDateTime=0x1d826fa, ftLastAccessTime.dwLowDateTime=0xc13a3c10, ftLastAccessTime.dwHighDateTime=0x1d82919, ftLastWriteTime.dwLowDateTime=0xc13a3c10, ftLastWriteTime.dwHighDateTime=0x1d82919, nFileSizeHigh=0x0, nFileSizeLow=0x14312, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Kj2cclMNfnRLyeGAiNp.swf", cAlternateFileName="KJ2CCL~1.SWF")) returned 1 [0252.420] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Kj2cclMNfnRLyeGAiNp.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kj2cclmnfnrlyegainp.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0252.420] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Kj2cclMNfnRLyeGAiNp.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kj2cclmnfnrlyegainp.swf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.421] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14312 [0252.421] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0252.421] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0252.476] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x14312, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x14312, lpOverlapped=0x0) returned 1 [0252.479] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x14320, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x14320, lpOverlapped=0x0) returned 1 [0252.481] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.552] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.578] CloseHandle (hObject=0xf8) returned 1 [0252.578] CloseHandle (hObject=0xec) returned 1 [0252.578] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Kj2cclMNfnRLyeGAiNp.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kj2cclmnfnrlyegainp.swf"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Kj2cclMNfnRLyeGAiNp.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kj2cclmnfnrlyegainp.swf.ozq0")) returned 0 [0252.580] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Kj2cclMNfnRLyeGAiNp.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kj2cclmnfnrlyegainp.swf.ozq0")) returned 0x2020 [0252.580] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Kj2cclMNfnRLyeGAiNp.swf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4ccb4d0, ftCreationTime.dwHighDateTime=0x1d826fa, ftLastAccessTime.dwLowDateTime=0xc13a3c10, ftLastAccessTime.dwHighDateTime=0x1d82919, ftLastWriteTime.dwLowDateTime=0xc13a3c10, ftLastWriteTime.dwHighDateTime=0x1d82919, nFileSizeHigh=0x0, nFileSizeLow=0x14312, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Kj2cclMNfnRLyeGAiNp.swf", cAlternateFileName="KJ2CCL~1.SWF")) returned 0x26dd48 [0252.580] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe4ccb4d0, ftCreationTime.dwHighDateTime=0x1d826fa, ftLastAccessTime.dwLowDateTime=0xc13a3c10, ftLastAccessTime.dwHighDateTime=0x1d82919, ftLastWriteTime.dwLowDateTime=0xc13a3c10, ftLastWriteTime.dwHighDateTime=0x1d82919, nFileSizeHigh=0x0, nFileSizeLow=0x14312, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Kj2cclMNfnRLyeGAiNp.swf", cAlternateFileName="KJ2CCL~1.SWF")) returned 0 [0252.580] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0252.580] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Kj2cclMNfnRLyeGAiNp.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kj2cclmnfnrlyegainp.swf")) returned 1 [0252.582] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Kj2cclMNfnRLyeGAiNp.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\kj2cclmnfnrlyegainp.swf")) returned 0xffffffff [0252.582] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59f18e00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x59f18e00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x59f18e00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Low", cAlternateFileName="")) returned 1 [0252.582] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Low\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59f18e00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x59f18e00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x59f18e00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c007a, dwReserved1=0x275de0, cFileName=".", cAlternateFileName="")) returned 0x275de0 [0252.584] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59f18e00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x59f18e00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x59f18e00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c007a, dwReserved1=0x275de0, cFileName="..", cAlternateFileName="")) returned 1 [0252.584] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x59f18e00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x59f18e00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x59f18e00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c007a, dwReserved1=0x275de0, cFileName="..", cAlternateFileName="")) returned 0 [0252.584] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0252.584] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f52b30, ftCreationTime.dwHighDateTime=0x1d81daf, ftLastAccessTime.dwLowDateTime=0x2e6203f0, ftLastAccessTime.dwHighDateTime=0x1d82216, ftLastWriteTime.dwLowDateTime=0x2e6203f0, ftLastWriteTime.dwHighDateTime=0x1d82216, nFileSizeHigh=0x0, nFileSizeLow=0x163e0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="LwFs VxFY7qaDr4H_W.png", cAlternateFileName="LWFSVX~1.PNG")) returned 1 [0252.584] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\LwFs VxFY7qaDr4H_W.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\lwfs vxfy7qadr4h_w.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.585] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\LwFs VxFY7qaDr4H_W.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\lwfs vxfy7qadr4h_w.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0252.586] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x163e0 [0252.586] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0252.586] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0252.638] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x163e0, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x163e0, lpOverlapped=0x0) returned 1 [0252.640] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x163f0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x163f0, lpOverlapped=0x0) returned 1 [0252.643] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.699] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.711] CloseHandle (hObject=0xec) returned 1 [0252.712] CloseHandle (hObject=0xf8) returned 1 [0252.712] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\LwFs VxFY7qaDr4H_W.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\lwfs vxfy7qadr4h_w.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\LwFs VxFY7qaDr4H_W.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\lwfs vxfy7qadr4h_w.png.ozq0")) returned 0 [0252.712] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\LwFs VxFY7qaDr4H_W.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\lwfs vxfy7qadr4h_w.png.ozq0")) returned 0x2020 [0252.713] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\LwFs VxFY7qaDr4H_W.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f52b30, ftCreationTime.dwHighDateTime=0x1d81daf, ftLastAccessTime.dwLowDateTime=0x2e6203f0, ftLastAccessTime.dwHighDateTime=0x1d82216, ftLastWriteTime.dwLowDateTime=0x2e6203f0, ftLastWriteTime.dwHighDateTime=0x1d82216, nFileSizeHigh=0x0, nFileSizeLow=0x163e0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="LwFs VxFY7qaDr4H_W.png", cAlternateFileName="LWFSVX~1.PNG")) returned 0x26dd48 [0252.713] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44f52b30, ftCreationTime.dwHighDateTime=0x1d81daf, ftLastAccessTime.dwLowDateTime=0x2e6203f0, ftLastAccessTime.dwHighDateTime=0x1d82216, ftLastWriteTime.dwLowDateTime=0x2e6203f0, ftLastWriteTime.dwHighDateTime=0x1d82216, nFileSizeHigh=0x0, nFileSizeLow=0x163e0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="LwFs VxFY7qaDr4H_W.png", cAlternateFileName="LWFSVX~1.PNG")) returned 0 [0252.713] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0252.713] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\LwFs VxFY7qaDr4H_W.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\lwfs vxfy7qadr4h_w.png")) returned 1 [0252.715] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\LwFs VxFY7qaDr4H_W.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\lwfs vxfy7qadr4h_w.png")) returned 0xffffffff [0252.715] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b3fc060, ftCreationTime.dwHighDateTime=0x1d8293d, ftLastAccessTime.dwLowDateTime=0xdfb9a8d0, ftLastAccessTime.dwHighDateTime=0x1d82962, ftLastWriteTime.dwLowDateTime=0xdfb9a8d0, ftLastWriteTime.dwHighDateTime=0x1d82962, nFileSizeHigh=0x0, nFileSizeLow=0x187ad, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="MinW0uprJD.png", cAlternateFileName="MINW0U~1.PNG")) returned 1 [0252.715] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MinW0uprJD.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\minw0uprjd.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0252.716] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MinW0uprJD.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\minw0uprjd.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.716] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x187ad [0252.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0252.717] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0252.781] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x187ad, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x187ad, lpOverlapped=0x0) returned 1 [0252.783] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x187b0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x187b0, lpOverlapped=0x0) returned 1 [0252.786] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.842] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.855] CloseHandle (hObject=0xf8) returned 1 [0252.855] CloseHandle (hObject=0xec) returned 1 [0252.855] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MinW0uprJD.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\minw0uprjd.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MinW0uprJD.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\minw0uprjd.png.ozq0")) returned 0 [0252.856] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MinW0uprJD.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\minw0uprjd.png.ozq0")) returned 0x2020 [0252.856] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MinW0uprJD.png", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b3fc060, ftCreationTime.dwHighDateTime=0x1d8293d, ftLastAccessTime.dwLowDateTime=0xdfb9a8d0, ftLastAccessTime.dwHighDateTime=0x1d82962, ftLastWriteTime.dwLowDateTime=0xdfb9a8d0, ftLastWriteTime.dwHighDateTime=0x1d82962, nFileSizeHigh=0x0, nFileSizeLow=0x187ad, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MinW0uprJD.png", cAlternateFileName="MINW0U~1.PNG")) returned 0x26dd48 [0252.856] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9b3fc060, ftCreationTime.dwHighDateTime=0x1d8293d, ftLastAccessTime.dwLowDateTime=0xdfb9a8d0, ftLastAccessTime.dwHighDateTime=0x1d82962, ftLastWriteTime.dwLowDateTime=0xdfb9a8d0, ftLastWriteTime.dwHighDateTime=0x1d82962, nFileSizeHigh=0x0, nFileSizeLow=0x187ad, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MinW0uprJD.png", cAlternateFileName="MINW0U~1.PNG")) returned 0 [0252.856] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0252.856] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MinW0uprJD.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\minw0uprjd.png")) returned 1 [0252.858] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MinW0uprJD.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\minw0uprjd.png")) returned 0xffffffff [0252.858] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31c53660, ftCreationTime.dwHighDateTime=0x1d82109, ftLastAccessTime.dwLowDateTime=0x8b0fb460, ftLastAccessTime.dwHighDateTime=0x1d82560, ftLastWriteTime.dwLowDateTime=0x8b0fb460, ftLastWriteTime.dwHighDateTime=0x1d82560, nFileSizeHigh=0x0, nFileSizeLow=0xc42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="MwwWmizgxx.pdf", cAlternateFileName="MWWWMI~1.PDF")) returned 1 [0252.858] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MwwWmizgxx.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mwwwmizgxx.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0252.858] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MwwWmizgxx.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mwwwmizgxx.pdf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0252.859] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc42d [0252.859] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0252.860] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0252.910] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc42d, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc42d, lpOverlapped=0x0) returned 1 [0252.912] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc430, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc430, lpOverlapped=0x0) returned 1 [0252.914] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0252.971] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0252.996] CloseHandle (hObject=0xec) returned 1 [0252.996] CloseHandle (hObject=0xf8) returned 1 [0252.996] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MwwWmizgxx.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mwwwmizgxx.pdf"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MwwWmizgxx.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mwwwmizgxx.pdf.ozq0")) returned 0 [0252.997] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MwwWmizgxx.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mwwwmizgxx.pdf.ozq0")) returned 0x2020 [0252.997] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MwwWmizgxx.pdf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31c53660, ftCreationTime.dwHighDateTime=0x1d82109, ftLastAccessTime.dwLowDateTime=0x8b0fb460, ftLastAccessTime.dwHighDateTime=0x1d82560, ftLastWriteTime.dwLowDateTime=0x8b0fb460, ftLastWriteTime.dwHighDateTime=0x1d82560, nFileSizeHigh=0x0, nFileSizeLow=0xc42d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MwwWmizgxx.pdf", cAlternateFileName="MWWWMI~1.PDF")) returned 0x26dd48 [0252.997] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x31c53660, ftCreationTime.dwHighDateTime=0x1d82109, ftLastAccessTime.dwLowDateTime=0x8b0fb460, ftLastAccessTime.dwHighDateTime=0x1d82560, ftLastWriteTime.dwLowDateTime=0x8b0fb460, ftLastWriteTime.dwHighDateTime=0x1d82560, nFileSizeHigh=0x0, nFileSizeLow=0xc42d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="MwwWmizgxx.pdf", cAlternateFileName="MWWWMI~1.PDF")) returned 0 [0252.997] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0252.997] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MwwWmizgxx.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mwwwmizgxx.pdf")) returned 1 [0252.999] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\MwwWmizgxx.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\mwwwmizgxx.pdf")) returned 0xffffffff [0252.999] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa54b3d0, ftCreationTime.dwHighDateTime=0x1d81cd1, ftLastAccessTime.dwLowDateTime=0xa9ab61e0, ftLastAccessTime.dwHighDateTime=0x1d8258c, ftLastWriteTime.dwLowDateTime=0xa9ab61e0, ftLastWriteTime.dwHighDateTime=0x1d8258c, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="n irk.mkv", cAlternateFileName="NIRK~1.MKV")) returned 1 [0253.000] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\n irk.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n irk.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0253.000] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\n irk.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n irk.mkv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.001] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9cd [0253.001] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0253.001] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0253.048] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9cd, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x9cd, lpOverlapped=0x0) returned 1 [0253.048] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x9d0, lpOverlapped=0x0) returned 1 [0253.050] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.101] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.112] CloseHandle (hObject=0xf8) returned 1 [0253.112] CloseHandle (hObject=0xec) returned 1 [0253.113] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\n irk.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n irk.mkv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\n irk.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n irk.mkv.ozq0")) returned 0 [0253.113] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\n irk.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n irk.mkv.ozq0")) returned 0x2020 [0253.113] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\n irk.mkv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa54b3d0, ftCreationTime.dwHighDateTime=0x1d81cd1, ftLastAccessTime.dwLowDateTime=0xa9ab61e0, ftLastAccessTime.dwHighDateTime=0x1d8258c, ftLastWriteTime.dwLowDateTime=0xa9ab61e0, ftLastWriteTime.dwHighDateTime=0x1d8258c, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="n irk.mkv", cAlternateFileName="NIRK~1.MKV")) returned 0x275de0 [0253.114] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa54b3d0, ftCreationTime.dwHighDateTime=0x1d81cd1, ftLastAccessTime.dwLowDateTime=0xa9ab61e0, ftLastAccessTime.dwHighDateTime=0x1d8258c, ftLastWriteTime.dwLowDateTime=0xa9ab61e0, ftLastWriteTime.dwHighDateTime=0x1d8258c, nFileSizeHigh=0x0, nFileSizeLow=0x9cd, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="n irk.mkv", cAlternateFileName="NIRK~1.MKV")) returned 0 [0253.114] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0253.114] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\n irk.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n irk.mkv")) returned 1 [0253.115] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\n irk.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n irk.mkv")) returned 0xffffffff [0253.115] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee5bc400, ftCreationTime.dwHighDateTime=0x1d8286c, ftLastAccessTime.dwLowDateTime=0xfa56ca00, ftLastAccessTime.dwHighDateTime=0x1d828f5, ftLastWriteTime.dwLowDateTime=0xfa56ca00, ftLastWriteTime.dwHighDateTime=0x1d828f5, nFileSizeHigh=0x0, nFileSizeLow=0x1e6c, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="N9wkc_MPWGvGPa4jm_.pdf", cAlternateFileName="N9WKC_~1.PDF")) returned 1 [0253.115] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\N9wkc_MPWGvGPa4jm_.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n9wkc_mpwgvgpa4jm_.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.116] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\N9wkc_MPWGvGPa4jm_.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n9wkc_mpwgvgpa4jm_.pdf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0253.117] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1e6c [0253.117] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0253.117] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0253.163] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1e6c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x1e6c, lpOverlapped=0x0) returned 1 [0253.164] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x1e70, lpOverlapped=0x0) returned 1 [0253.166] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.219] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.230] CloseHandle (hObject=0xec) returned 1 [0253.230] CloseHandle (hObject=0xf8) returned 1 [0253.231] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\N9wkc_MPWGvGPa4jm_.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n9wkc_mpwgvgpa4jm_.pdf"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\N9wkc_MPWGvGPa4jm_.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n9wkc_mpwgvgpa4jm_.pdf.ozq0")) returned 0 [0253.231] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\N9wkc_MPWGvGPa4jm_.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n9wkc_mpwgvgpa4jm_.pdf.ozq0")) returned 0x2020 [0253.231] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\N9wkc_MPWGvGPa4jm_.pdf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee5bc400, ftCreationTime.dwHighDateTime=0x1d8286c, ftLastAccessTime.dwLowDateTime=0xfa56ca00, ftLastAccessTime.dwHighDateTime=0x1d828f5, ftLastWriteTime.dwLowDateTime=0xfa56ca00, ftLastWriteTime.dwHighDateTime=0x1d828f5, nFileSizeHigh=0x0, nFileSizeLow=0x1e6c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="N9wkc_MPWGvGPa4jm_.pdf", cAlternateFileName="N9WKC_~1.PDF")) returned 0x26dd48 [0253.231] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xee5bc400, ftCreationTime.dwHighDateTime=0x1d8286c, ftLastAccessTime.dwLowDateTime=0xfa56ca00, ftLastAccessTime.dwHighDateTime=0x1d828f5, ftLastWriteTime.dwLowDateTime=0xfa56ca00, ftLastWriteTime.dwHighDateTime=0x1d828f5, nFileSizeHigh=0x0, nFileSizeLow=0x1e6c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="N9wkc_MPWGvGPa4jm_.pdf", cAlternateFileName="N9WKC_~1.PDF")) returned 0 [0253.232] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0253.232] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\N9wkc_MPWGvGPa4jm_.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n9wkc_mpwgvgpa4jm_.pdf")) returned 1 [0253.233] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\N9wkc_MPWGvGPa4jm_.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\n9wkc_mpwgvgpa4jm_.pdf")) returned 0xffffffff [0253.233] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1224340, ftCreationTime.dwHighDateTime=0x1d82415, ftLastAccessTime.dwLowDateTime=0xfc6cb960, ftLastAccessTime.dwHighDateTime=0x1d8251e, ftLastWriteTime.dwLowDateTime=0xfc6cb960, ftLastWriteTime.dwHighDateTime=0x1d8251e, nFileSizeHigh=0x0, nFileSizeLow=0x74c2, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Nza5uYAEwAnZt2NuQovL.bmp", cAlternateFileName="NZA5UY~1.BMP")) returned 1 [0253.233] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Nza5uYAEwAnZt2NuQovL.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\nza5uyaewanzt2nuqovl.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0253.233] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Nza5uYAEwAnZt2NuQovL.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\nza5uyaewanzt2nuqovl.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.234] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x74c2 [0253.234] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0253.235] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0253.281] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x74c2, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x74c2, lpOverlapped=0x0) returned 1 [0253.282] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x74d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x74d0, lpOverlapped=0x0) returned 1 [0253.284] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.337] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.348] CloseHandle (hObject=0xf8) returned 1 [0253.348] CloseHandle (hObject=0xec) returned 1 [0253.348] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Nza5uYAEwAnZt2NuQovL.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\nza5uyaewanzt2nuqovl.bmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Nza5uYAEwAnZt2NuQovL.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\nza5uyaewanzt2nuqovl.bmp.ozq0")) returned 0 [0253.349] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Nza5uYAEwAnZt2NuQovL.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\nza5uyaewanzt2nuqovl.bmp.ozq0")) returned 0x2020 [0253.349] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Nza5uYAEwAnZt2NuQovL.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1224340, ftCreationTime.dwHighDateTime=0x1d82415, ftLastAccessTime.dwLowDateTime=0xfc6cb960, ftLastAccessTime.dwHighDateTime=0x1d8251e, ftLastWriteTime.dwLowDateTime=0xfc6cb960, ftLastWriteTime.dwHighDateTime=0x1d8251e, nFileSizeHigh=0x0, nFileSizeLow=0x74c2, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Nza5uYAEwAnZt2NuQovL.bmp", cAlternateFileName="NZA5UY~1.BMP")) returned 0x26dd48 [0253.349] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1224340, ftCreationTime.dwHighDateTime=0x1d82415, ftLastAccessTime.dwLowDateTime=0xfc6cb960, ftLastAccessTime.dwHighDateTime=0x1d8251e, ftLastWriteTime.dwLowDateTime=0xfc6cb960, ftLastWriteTime.dwHighDateTime=0x1d8251e, nFileSizeHigh=0x0, nFileSizeLow=0x74c2, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Nza5uYAEwAnZt2NuQovL.bmp", cAlternateFileName="NZA5UY~1.BMP")) returned 0 [0253.349] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0253.350] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Nza5uYAEwAnZt2NuQovL.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\nza5uyaewanzt2nuqovl.bmp")) returned 1 [0253.351] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Nza5uYAEwAnZt2NuQovL.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\nza5uyaewanzt2nuqovl.bmp")) returned 0xffffffff [0253.351] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x676e4b90, ftCreationTime.dwHighDateTime=0x1d8241e, ftLastAccessTime.dwLowDateTime=0xdd427990, ftLastAccessTime.dwHighDateTime=0x1d829aa, ftLastWriteTime.dwLowDateTime=0xdd427990, ftLastWriteTime.dwHighDateTime=0x1d829aa, nFileSizeHigh=0x0, nFileSizeLow=0x16a8, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="OmUbv.mp4", cAlternateFileName="")) returned 1 [0253.351] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OmUbv.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\omubv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.351] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OmUbv.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\omubv.mp4.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0253.352] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x16a8 [0253.352] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0253.353] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0253.407] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x16a8, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x16a8, lpOverlapped=0x0) returned 1 [0253.408] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x16b0, lpOverlapped=0x0) returned 1 [0253.409] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.467] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.480] CloseHandle (hObject=0xec) returned 1 [0253.480] CloseHandle (hObject=0xf8) returned 1 [0253.480] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OmUbv.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\omubv.mp4"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OmUbv.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\omubv.mp4.ozq0")) returned 0 [0253.481] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OmUbv.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\omubv.mp4.ozq0")) returned 0x2020 [0253.481] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OmUbv.mp4", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x676e4b90, ftCreationTime.dwHighDateTime=0x1d8241e, ftLastAccessTime.dwLowDateTime=0xdd427990, ftLastAccessTime.dwHighDateTime=0x1d829aa, ftLastWriteTime.dwLowDateTime=0xdd427990, ftLastWriteTime.dwHighDateTime=0x1d829aa, nFileSizeHigh=0x0, nFileSizeLow=0x16a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="OmUbv.mp4", cAlternateFileName="")) returned 0x275de0 [0253.481] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x676e4b90, ftCreationTime.dwHighDateTime=0x1d8241e, ftLastAccessTime.dwLowDateTime=0xdd427990, ftLastAccessTime.dwHighDateTime=0x1d829aa, ftLastWriteTime.dwLowDateTime=0xdd427990, ftLastWriteTime.dwHighDateTime=0x1d829aa, nFileSizeHigh=0x0, nFileSizeLow=0x16a8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="OmUbv.mp4", cAlternateFileName="")) returned 0 [0253.481] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0253.482] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OmUbv.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\omubv.mp4")) returned 1 [0253.483] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OmUbv.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\omubv.mp4")) returned 0xffffffff [0253.483] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed48c960, ftCreationTime.dwHighDateTime=0x1d81c63, ftLastAccessTime.dwLowDateTime=0xacc3e9e0, ftLastAccessTime.dwHighDateTime=0x1d81ea4, ftLastWriteTime.dwLowDateTime=0xacc3e9e0, ftLastWriteTime.dwHighDateTime=0x1d81ea4, nFileSizeHigh=0x0, nFileSizeLow=0x98c8, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="OOxwV.mp4", cAlternateFileName="")) returned 1 [0253.483] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OOxwV.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ooxwv.mp4"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0253.483] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OOxwV.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ooxwv.mp4.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.484] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98c8 [0253.484] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0253.485] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0253.532] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x98c8, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x98c8, lpOverlapped=0x0) returned 1 [0253.533] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x98d0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x98d0, lpOverlapped=0x0) returned 1 [0253.535] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.601] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.613] CloseHandle (hObject=0xf8) returned 1 [0253.613] CloseHandle (hObject=0xec) returned 1 [0253.614] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OOxwV.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ooxwv.mp4"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OOxwV.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ooxwv.mp4.ozq0")) returned 0 [0253.614] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OOxwV.mp4.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ooxwv.mp4.ozq0")) returned 0x2020 [0253.614] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OOxwV.mp4", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed48c960, ftCreationTime.dwHighDateTime=0x1d81c63, ftLastAccessTime.dwLowDateTime=0xacc3e9e0, ftLastAccessTime.dwHighDateTime=0x1d81ea4, ftLastWriteTime.dwLowDateTime=0xacc3e9e0, ftLastWriteTime.dwHighDateTime=0x1d81ea4, nFileSizeHigh=0x0, nFileSizeLow=0x98c8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="OOxwV.mp4", cAlternateFileName="")) returned 0x275de0 [0253.615] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xed48c960, ftCreationTime.dwHighDateTime=0x1d81c63, ftLastAccessTime.dwLowDateTime=0xacc3e9e0, ftLastAccessTime.dwHighDateTime=0x1d81ea4, ftLastWriteTime.dwLowDateTime=0xacc3e9e0, ftLastWriteTime.dwHighDateTime=0x1d81ea4, nFileSizeHigh=0x0, nFileSizeLow=0x98c8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="OOxwV.mp4", cAlternateFileName="")) returned 0 [0253.615] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0253.615] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OOxwV.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ooxwv.mp4")) returned 1 [0253.616] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\OOxwV.mp4" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\ooxwv.mp4")) returned 0xffffffff [0253.616] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c094b30, ftCreationTime.dwHighDateTime=0x1d82876, ftLastAccessTime.dwLowDateTime=0x2b5ee500, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x2b5ee500, ftLastWriteTime.dwHighDateTime=0x1d82988, nFileSizeHigh=0x0, nFileSizeLow=0xd7ef, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Q0WYj1su t.avi", cAlternateFileName="Q0WYJ1~1.AVI")) returned 1 [0253.617] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Q0WYj1su t.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\q0wyj1su t.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.617] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Q0WYj1su t.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\q0wyj1su t.avi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0253.618] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7ef [0253.618] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0253.619] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0253.673] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd7ef, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xd7ef, lpOverlapped=0x0) returned 1 [0253.675] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd7f0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xd7f0, lpOverlapped=0x0) returned 1 [0253.678] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.738] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.753] CloseHandle (hObject=0xec) returned 1 [0253.753] CloseHandle (hObject=0xf8) returned 1 [0253.753] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Q0WYj1su t.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\q0wyj1su t.avi"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Q0WYj1su t.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\q0wyj1su t.avi.ozq0")) returned 0 [0253.754] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Q0WYj1su t.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\q0wyj1su t.avi.ozq0")) returned 0x2020 [0253.754] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Q0WYj1su t.avi", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c094b30, ftCreationTime.dwHighDateTime=0x1d82876, ftLastAccessTime.dwLowDateTime=0x2b5ee500, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x2b5ee500, ftLastWriteTime.dwHighDateTime=0x1d82988, nFileSizeHigh=0x0, nFileSizeLow=0xd7ef, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Q0WYj1su t.avi", cAlternateFileName="Q0WYJ1~1.AVI")) returned 0x26dd48 [0253.754] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6c094b30, ftCreationTime.dwHighDateTime=0x1d82876, ftLastAccessTime.dwLowDateTime=0x2b5ee500, ftLastAccessTime.dwHighDateTime=0x1d82988, ftLastWriteTime.dwLowDateTime=0x2b5ee500, ftLastWriteTime.dwHighDateTime=0x1d82988, nFileSizeHigh=0x0, nFileSizeLow=0xd7ef, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Q0WYj1su t.avi", cAlternateFileName="Q0WYJ1~1.AVI")) returned 0 [0253.754] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0253.754] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Q0WYj1su t.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\q0wyj1su t.avi")) returned 1 [0253.756] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\Q0WYj1su t.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\q0wyj1su t.avi")) returned 0xffffffff [0253.756] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf3bfb0, ftCreationTime.dwHighDateTime=0x1d828f2, ftLastAccessTime.dwLowDateTime=0x2b4ede00, ftLastAccessTime.dwHighDateTime=0x1d82a0d, ftLastWriteTime.dwLowDateTime=0x2b4ede00, ftLastWriteTime.dwHighDateTime=0x1d82a0d, nFileSizeHigh=0x0, nFileSizeLow=0xb9fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="qChowxzkhhg.jpg", cAlternateFileName="QCHOWX~1.JPG")) returned 1 [0253.756] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\qChowxzkhhg.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\qchowxzkhhg.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0253.756] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\qChowxzkhhg.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\qchowxzkhhg.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.757] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb9fd [0253.757] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0253.758] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0253.815] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xb9fd, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xb9fd, lpOverlapped=0x0) returned 1 [0253.817] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xba00, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xba00, lpOverlapped=0x0) returned 1 [0253.820] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0253.879] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0253.902] CloseHandle (hObject=0xf8) returned 1 [0253.902] CloseHandle (hObject=0xec) returned 1 [0253.902] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\qChowxzkhhg.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\qchowxzkhhg.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\qChowxzkhhg.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\qchowxzkhhg.jpg.ozq0")) returned 0 [0253.903] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\qChowxzkhhg.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\qchowxzkhhg.jpg.ozq0")) returned 0x2020 [0253.903] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\qChowxzkhhg.jpg", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf3bfb0, ftCreationTime.dwHighDateTime=0x1d828f2, ftLastAccessTime.dwLowDateTime=0x2b4ede00, ftLastAccessTime.dwHighDateTime=0x1d82a0d, ftLastWriteTime.dwLowDateTime=0x2b4ede00, ftLastWriteTime.dwHighDateTime=0x1d82a0d, nFileSizeHigh=0x0, nFileSizeLow=0xb9fd, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="qChowxzkhhg.jpg", cAlternateFileName="QCHOWX~1.JPG")) returned 0x26dd48 [0253.903] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf3bfb0, ftCreationTime.dwHighDateTime=0x1d828f2, ftLastAccessTime.dwLowDateTime=0x2b4ede00, ftLastAccessTime.dwHighDateTime=0x1d82a0d, ftLastWriteTime.dwLowDateTime=0x2b4ede00, ftLastWriteTime.dwHighDateTime=0x1d82a0d, nFileSizeHigh=0x0, nFileSizeLow=0xb9fd, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="qChowxzkhhg.jpg", cAlternateFileName="QCHOWX~1.JPG")) returned 0 [0253.903] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0253.903] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\qChowxzkhhg.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\qchowxzkhhg.jpg")) returned 1 [0253.904] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\qChowxzkhhg.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\qchowxzkhhg.jpg")) returned 0xffffffff [0253.904] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50823f60, ftCreationTime.dwHighDateTime=0x1d82426, ftLastAccessTime.dwLowDateTime=0x9b49ed10, ftLastAccessTime.dwHighDateTime=0x1d8288e, ftLastWriteTime.dwLowDateTime=0x9b49ed10, ftLastWriteTime.dwHighDateTime=0x1d8288e, nFileSizeHigh=0x0, nFileSizeLow=0xde2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RNIOgFH247sGsH3LFN.jpg", cAlternateFileName="RNIOGF~1.JPG")) returned 1 [0253.905] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\RNIOgFH247sGsH3LFN.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\rniogfh247sgsh3lfn.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0253.905] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\RNIOgFH247sGsH3LFN.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\rniogfh247sgsh3lfn.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0253.906] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde2c [0253.906] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0253.906] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0253.953] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xde2c, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xde2c, lpOverlapped=0x0) returned 1 [0253.955] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xde30, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xde30, lpOverlapped=0x0) returned 1 [0253.957] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.031] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.043] CloseHandle (hObject=0xec) returned 1 [0254.043] CloseHandle (hObject=0xf8) returned 1 [0254.043] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\RNIOgFH247sGsH3LFN.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\rniogfh247sgsh3lfn.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\RNIOgFH247sGsH3LFN.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\rniogfh247sgsh3lfn.jpg.ozq0")) returned 0 [0254.044] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\RNIOgFH247sGsH3LFN.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\rniogfh247sgsh3lfn.jpg.ozq0")) returned 0x2020 [0254.044] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\RNIOgFH247sGsH3LFN.jpg", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50823f60, ftCreationTime.dwHighDateTime=0x1d82426, ftLastAccessTime.dwLowDateTime=0x9b49ed10, ftLastAccessTime.dwHighDateTime=0x1d8288e, ftLastWriteTime.dwLowDateTime=0x9b49ed10, ftLastWriteTime.dwHighDateTime=0x1d8288e, nFileSizeHigh=0x0, nFileSizeLow=0xde2c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="RNIOgFH247sGsH3LFN.jpg", cAlternateFileName="RNIOGF~1.JPG")) returned 0x26dd48 [0254.044] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50823f60, ftCreationTime.dwHighDateTime=0x1d82426, ftLastAccessTime.dwLowDateTime=0x9b49ed10, ftLastAccessTime.dwHighDateTime=0x1d8288e, ftLastWriteTime.dwLowDateTime=0x9b49ed10, ftLastWriteTime.dwHighDateTime=0x1d8288e, nFileSizeHigh=0x0, nFileSizeLow=0xde2c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="RNIOgFH247sGsH3LFN.jpg", cAlternateFileName="RNIOGF~1.JPG")) returned 0 [0254.044] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0254.044] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\RNIOgFH247sGsH3LFN.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\rniogfh247sgsh3lfn.jpg")) returned 1 [0254.046] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\RNIOgFH247sGsH3LFN.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\rniogfh247sgsh3lfn.jpg")) returned 0xffffffff [0254.046] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bb4e760, ftCreationTime.dwHighDateTime=0x1d82868, ftLastAccessTime.dwLowDateTime=0x20709f30, ftLastAccessTime.dwHighDateTime=0x1d8296f, ftLastWriteTime.dwLowDateTime=0x20709f30, ftLastWriteTime.dwHighDateTime=0x1d8296f, nFileSizeHigh=0x0, nFileSizeLow=0xd0a4, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="s7ZpdDyvkB4lsk.flv", cAlternateFileName="S7ZPDD~1.FLV")) returned 1 [0254.046] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\s7ZpdDyvkB4lsk.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\s7zpddyvkb4lsk.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0254.046] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\s7ZpdDyvkB4lsk.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\s7zpddyvkb4lsk.flv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.047] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd0a4 [0254.047] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0254.047] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0254.095] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd0a4, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xd0a4, lpOverlapped=0x0) returned 1 [0254.097] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd0b0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xd0b0, lpOverlapped=0x0) returned 1 [0254.099] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.176] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.192] CloseHandle (hObject=0xf8) returned 1 [0254.193] CloseHandle (hObject=0xec) returned 1 [0254.198] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\s7ZpdDyvkB4lsk.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\s7zpddyvkb4lsk.flv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\s7ZpdDyvkB4lsk.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\s7zpddyvkb4lsk.flv.ozq0")) returned 0 [0254.200] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\s7ZpdDyvkB4lsk.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\s7zpddyvkb4lsk.flv.ozq0")) returned 0x2020 [0254.200] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\s7ZpdDyvkB4lsk.flv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bb4e760, ftCreationTime.dwHighDateTime=0x1d82868, ftLastAccessTime.dwLowDateTime=0x20709f30, ftLastAccessTime.dwHighDateTime=0x1d8296f, ftLastWriteTime.dwLowDateTime=0x20709f30, ftLastWriteTime.dwHighDateTime=0x1d8296f, nFileSizeHigh=0x0, nFileSizeLow=0xd0a4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="s7ZpdDyvkB4lsk.flv", cAlternateFileName="S7ZPDD~1.FLV")) returned 0x26dd48 [0254.201] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1bb4e760, ftCreationTime.dwHighDateTime=0x1d82868, ftLastAccessTime.dwLowDateTime=0x20709f30, ftLastAccessTime.dwHighDateTime=0x1d8296f, ftLastWriteTime.dwLowDateTime=0x20709f30, ftLastWriteTime.dwHighDateTime=0x1d8296f, nFileSizeHigh=0x0, nFileSizeLow=0xd0a4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="s7ZpdDyvkB4lsk.flv", cAlternateFileName="S7ZPDD~1.FLV")) returned 0 [0254.201] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0254.201] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\s7ZpdDyvkB4lsk.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\s7zpddyvkb4lsk.flv")) returned 1 [0254.204] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\s7ZpdDyvkB4lsk.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\s7zpddyvkb4lsk.flv")) returned 0xffffffff [0254.204] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73c97280, ftCreationTime.dwHighDateTime=0x1d81b5d, ftLastAccessTime.dwLowDateTime=0x7c105f00, ftLastAccessTime.dwHighDateTime=0x1d828bc, ftLastWriteTime.dwLowDateTime=0x7c105f00, ftLastWriteTime.dwHighDateTime=0x1d828bc, nFileSizeHigh=0x0, nFileSizeLow=0xae93, dwReserved0=0x0, dwReserved1=0x0, cFileName="seLG58F6tQ3Bx.bmp", cAlternateFileName="SELG58~1.BMP")) returned 1 [0254.204] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\seLG58F6tQ3Bx.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\selg58f6tq3bx.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.204] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\seLG58F6tQ3Bx.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\selg58f6tq3bx.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0254.207] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xae93 [0254.207] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0254.208] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0254.270] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xae93, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xae93, lpOverlapped=0x0) returned 1 [0254.272] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xaea0, lpOverlapped=0x0) returned 1 [0254.275] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.340] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.352] CloseHandle (hObject=0xec) returned 1 [0254.352] CloseHandle (hObject=0xf8) returned 1 [0254.352] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\seLG58F6tQ3Bx.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\selg58f6tq3bx.bmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\seLG58F6tQ3Bx.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\selg58f6tq3bx.bmp.ozq0")) returned 0 [0254.353] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\seLG58F6tQ3Bx.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\selg58f6tq3bx.bmp.ozq0")) returned 0x2020 [0254.353] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\seLG58F6tQ3Bx.bmp", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73c97280, ftCreationTime.dwHighDateTime=0x1d81b5d, ftLastAccessTime.dwLowDateTime=0x7c105f00, ftLastAccessTime.dwHighDateTime=0x1d828bc, ftLastWriteTime.dwLowDateTime=0x7c105f00, ftLastWriteTime.dwHighDateTime=0x1d828bc, nFileSizeHigh=0x0, nFileSizeLow=0xae93, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="seLG58F6tQ3Bx.bmp", cAlternateFileName="SELG58~1.BMP")) returned 0x26dd48 [0254.353] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x73c97280, ftCreationTime.dwHighDateTime=0x1d81b5d, ftLastAccessTime.dwLowDateTime=0x7c105f00, ftLastAccessTime.dwHighDateTime=0x1d828bc, ftLastWriteTime.dwLowDateTime=0x7c105f00, ftLastWriteTime.dwHighDateTime=0x1d828bc, nFileSizeHigh=0x0, nFileSizeLow=0xae93, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="seLG58F6tQ3Bx.bmp", cAlternateFileName="SELG58~1.BMP")) returned 0 [0254.353] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0254.353] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\seLG58F6tQ3Bx.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\selg58f6tq3bx.bmp")) returned 1 [0254.354] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\seLG58F6tQ3Bx.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\selg58f6tq3bx.bmp")) returned 0xffffffff [0254.354] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79f6630, ftCreationTime.dwHighDateTime=0x1d81c81, ftLastAccessTime.dwLowDateTime=0xfeaad910, ftLastAccessTime.dwHighDateTime=0x1d81d48, ftLastWriteTime.dwLowDateTime=0xfeaad910, ftLastWriteTime.dwHighDateTime=0x1d81d48, nFileSizeHigh=0x0, nFileSizeLow=0x15897, dwReserved0=0x0, dwReserved1=0x0, cFileName="sQp_U.swf", cAlternateFileName="")) returned 1 [0254.355] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\sQp_U.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\sqp_u.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0254.355] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\sQp_U.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\sqp_u.swf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.356] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x15897 [0254.356] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0254.356] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0254.402] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x15897, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x15897, lpOverlapped=0x0) returned 1 [0254.404] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x158a0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x158a0, lpOverlapped=0x0) returned 1 [0254.407] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.468] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.481] CloseHandle (hObject=0xf8) returned 1 [0254.481] CloseHandle (hObject=0xec) returned 1 [0254.481] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\sQp_U.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\sqp_u.swf"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\sQp_U.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\sqp_u.swf.ozq0")) returned 0 [0254.482] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\sQp_U.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\sqp_u.swf.ozq0")) returned 0x2020 [0254.482] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\sQp_U.swf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79f6630, ftCreationTime.dwHighDateTime=0x1d81c81, ftLastAccessTime.dwLowDateTime=0xfeaad910, ftLastAccessTime.dwHighDateTime=0x1d81d48, ftLastWriteTime.dwLowDateTime=0xfeaad910, ftLastWriteTime.dwHighDateTime=0x1d81d48, nFileSizeHigh=0x0, nFileSizeLow=0x15897, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="sQp_U.swf", cAlternateFileName="")) returned 0x275de0 [0254.482] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa79f6630, ftCreationTime.dwHighDateTime=0x1d81c81, ftLastAccessTime.dwLowDateTime=0xfeaad910, ftLastAccessTime.dwHighDateTime=0x1d81d48, ftLastWriteTime.dwLowDateTime=0xfeaad910, ftLastWriteTime.dwHighDateTime=0x1d81d48, nFileSizeHigh=0x0, nFileSizeLow=0x15897, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="sQp_U.swf", cAlternateFileName="")) returned 0 [0254.482] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0254.483] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\sQp_U.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\sqp_u.swf")) returned 1 [0254.484] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\sQp_U.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\sqp_u.swf")) returned 0xffffffff [0254.484] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3a8d0, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0x95db19d0, ftLastAccessTime.dwHighDateTime=0x1d82582, ftLastWriteTime.dwLowDateTime=0x95db19d0, ftLastWriteTime.dwHighDateTime=0x1d82582, nFileSizeHigh=0x0, nFileSizeLow=0xc861, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="TEgLAQCdoM.csv", cAlternateFileName="TEGLAQ~1.CSV")) returned 1 [0254.485] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\TEgLAQCdoM.csv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\teglaqcdom.csv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.485] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\TEgLAQCdoM.csv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\teglaqcdom.csv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0254.486] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc861 [0254.486] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0254.486] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0254.536] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc861, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0xc861, lpOverlapped=0x0) returned 1 [0254.537] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc870, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0xc870, lpOverlapped=0x0) returned 1 [0254.549] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.627] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.639] CloseHandle (hObject=0xec) returned 1 [0254.639] CloseHandle (hObject=0xf8) returned 1 [0254.640] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\TEgLAQCdoM.csv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\teglaqcdom.csv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\TEgLAQCdoM.csv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\teglaqcdom.csv.ozq0")) returned 0 [0254.640] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\TEgLAQCdoM.csv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\teglaqcdom.csv.ozq0")) returned 0x2020 [0254.640] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\TEgLAQCdoM.csv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3a8d0, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0x95db19d0, ftLastAccessTime.dwHighDateTime=0x1d82582, ftLastWriteTime.dwLowDateTime=0x95db19d0, ftLastWriteTime.dwHighDateTime=0x1d82582, nFileSizeHigh=0x0, nFileSizeLow=0xc861, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="TEgLAQCdoM.csv", cAlternateFileName="TEGLAQ~1.CSV")) returned 0x26dd48 [0254.640] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c3a8d0, ftCreationTime.dwHighDateTime=0x1d81c87, ftLastAccessTime.dwLowDateTime=0x95db19d0, ftLastAccessTime.dwHighDateTime=0x1d82582, ftLastWriteTime.dwLowDateTime=0x95db19d0, ftLastWriteTime.dwHighDateTime=0x1d82582, nFileSizeHigh=0x0, nFileSizeLow=0xc861, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="TEgLAQCdoM.csv", cAlternateFileName="TEGLAQ~1.CSV")) returned 0 [0254.641] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0254.641] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\TEgLAQCdoM.csv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\teglaqcdom.csv")) returned 1 [0254.642] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\TEgLAQCdoM.csv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\teglaqcdom.csv")) returned 0xffffffff [0254.642] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5948c30, ftCreationTime.dwHighDateTime=0x1d81f47, ftLastAccessTime.dwLowDateTime=0x14a0b030, ftLastAccessTime.dwHighDateTime=0x1d8261a, ftLastWriteTime.dwLowDateTime=0x14a0b030, ftLastWriteTime.dwHighDateTime=0x1d8261a, nFileSizeHigh=0x0, nFileSizeLow=0x7156, dwReserved0=0x0, dwReserved1=0x0, cFileName="vv1bruMtyIoKkS.gif", cAlternateFileName="VV1BRU~1.GIF")) returned 1 [0254.642] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\vv1bruMtyIoKkS.gif" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\vv1brumtyiokks.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0254.643] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\vv1bruMtyIoKkS.gif.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\vv1brumtyiokks.gif.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.643] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x7156 [0254.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0254.644] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0254.689] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x7156, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x7156, lpOverlapped=0x0) returned 1 [0254.691] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x7160, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x7160, lpOverlapped=0x0) returned 1 [0254.692] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.755] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.767] CloseHandle (hObject=0xf8) returned 1 [0254.767] CloseHandle (hObject=0xec) returned 1 [0254.767] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\vv1bruMtyIoKkS.gif" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\vv1brumtyiokks.gif"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\vv1bruMtyIoKkS.gif.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\vv1brumtyiokks.gif.ozq0")) returned 0 [0254.768] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\vv1bruMtyIoKkS.gif.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\vv1brumtyiokks.gif.ozq0")) returned 0x2020 [0254.768] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\vv1bruMtyIoKkS.gif", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5948c30, ftCreationTime.dwHighDateTime=0x1d81f47, ftLastAccessTime.dwLowDateTime=0x14a0b030, ftLastAccessTime.dwHighDateTime=0x1d8261a, ftLastWriteTime.dwLowDateTime=0x14a0b030, ftLastWriteTime.dwHighDateTime=0x1d8261a, nFileSizeHigh=0x0, nFileSizeLow=0x7156, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="vv1bruMtyIoKkS.gif", cAlternateFileName="VV1BRU~1.GIF")) returned 0x26dd48 [0254.768] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5948c30, ftCreationTime.dwHighDateTime=0x1d81f47, ftLastAccessTime.dwLowDateTime=0x14a0b030, ftLastAccessTime.dwHighDateTime=0x1d8261a, ftLastWriteTime.dwLowDateTime=0x14a0b030, ftLastWriteTime.dwHighDateTime=0x1d8261a, nFileSizeHigh=0x0, nFileSizeLow=0x7156, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="vv1bruMtyIoKkS.gif", cAlternateFileName="VV1BRU~1.GIF")) returned 0 [0254.768] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0254.768] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\vv1bruMtyIoKkS.gif" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\vv1brumtyiokks.gif")) returned 1 [0254.769] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\vv1bruMtyIoKkS.gif" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\vv1brumtyiokks.gif")) returned 0xffffffff [0254.769] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c961ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x2c961ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x2c961ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1 [0254.769] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c961ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x2c961ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x2c961ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x25f898, cFileName=".", cAlternateFileName="")) returned 0x275de0 [0254.770] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c961ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x2c961ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x2c961ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x25f898, cFileName="..", cAlternateFileName="")) returned 1 [0254.770] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2c961ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x2c961ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x2c961ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x720070, dwReserved1=0x25f898, cFileName="..", cAlternateFileName="")) returned 0 [0254.770] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0254.770] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78cf00b0, ftCreationTime.dwHighDateTime=0x1d8225b, ftLastAccessTime.dwLowDateTime=0xba8402c0, ftLastAccessTime.dwHighDateTime=0x1d824af, ftLastWriteTime.dwLowDateTime=0xba8402c0, ftLastWriteTime.dwHighDateTime=0x1d824af, nFileSizeHigh=0x0, nFileSizeLow=0x17ce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XDnZ2fFbtXqShzjaRCM.pdf", cAlternateFileName="XDNZ2F~1.PDF")) returned 1 [0254.771] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\XDnZ2fFbtXqShzjaRCM.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\xdnz2ffbtxqshzjarcm.pdf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.771] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\XDnZ2fFbtXqShzjaRCM.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\xdnz2ffbtxqshzjarcm.pdf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0254.772] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17ce0 [0254.772] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0254.772] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0254.828] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x17ce0, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x17ce0, lpOverlapped=0x0) returned 1 [0254.830] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17cf0, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x17cf0, lpOverlapped=0x0) returned 1 [0254.833] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0254.892] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0254.913] CloseHandle (hObject=0xec) returned 1 [0254.913] CloseHandle (hObject=0xf8) returned 1 [0254.913] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\XDnZ2fFbtXqShzjaRCM.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\xdnz2ffbtxqshzjarcm.pdf"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\XDnZ2fFbtXqShzjaRCM.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\xdnz2ffbtxqshzjarcm.pdf.ozq0")) returned 0 [0254.914] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\XDnZ2fFbtXqShzjaRCM.pdf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\xdnz2ffbtxqshzjarcm.pdf.ozq0")) returned 0x2020 [0254.914] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\XDnZ2fFbtXqShzjaRCM.pdf", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78cf00b0, ftCreationTime.dwHighDateTime=0x1d8225b, ftLastAccessTime.dwLowDateTime=0xba8402c0, ftLastAccessTime.dwHighDateTime=0x1d824af, ftLastWriteTime.dwLowDateTime=0xba8402c0, ftLastWriteTime.dwHighDateTime=0x1d824af, nFileSizeHigh=0x0, nFileSizeLow=0x17ce0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="XDnZ2fFbtXqShzjaRCM.pdf", cAlternateFileName="XDNZ2F~1.PDF")) returned 0x26dd48 [0254.914] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x78cf00b0, ftCreationTime.dwHighDateTime=0x1d8225b, ftLastAccessTime.dwLowDateTime=0xba8402c0, ftLastAccessTime.dwHighDateTime=0x1d824af, ftLastWriteTime.dwLowDateTime=0xba8402c0, ftLastWriteTime.dwHighDateTime=0x1d824af, nFileSizeHigh=0x0, nFileSizeLow=0x17ce0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="XDnZ2fFbtXqShzjaRCM.pdf", cAlternateFileName="XDNZ2F~1.PDF")) returned 0 [0254.914] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0254.914] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\XDnZ2fFbtXqShzjaRCM.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\xdnz2ffbtxqshzjarcm.pdf")) returned 1 [0254.916] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\XDnZ2fFbtXqShzjaRCM.pdf" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\xdnz2ffbtxqshzjarcm.pdf")) returned 0xffffffff [0254.916] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1f04ec00, ftCreationTime.dwHighDateTime=0x1d81c4f, ftLastAccessTime.dwLowDateTime=0xa1e690b0, ftLastAccessTime.dwHighDateTime=0x1d824f1, ftLastWriteTime.dwLowDateTime=0xa1e690b0, ftLastWriteTime.dwHighDateTime=0x1d824f1, nFileSizeHigh=0x0, nFileSizeLow=0x3144, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="z8yW99.mkv", cAlternateFileName="")) returned 1 [0254.916] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\z8yW99.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\z8yw99.mkv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0254.916] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\z8yW99.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\z8yw99.mkv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0254.917] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3144 [0254.917] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0254.918] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0254.968] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3144, lpNumberOfBytesRead=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f038*=0x3144, lpOverlapped=0x0) returned 1 [0254.970] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3150, lpNumberOfBytesWritten=0x18f038, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f038*=0x3150, lpOverlapped=0x0) returned 1 [0254.971] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.086] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.097] CloseHandle (hObject=0xf8) returned 1 [0255.097] CloseHandle (hObject=0xec) returned 1 [0255.098] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\z8yW99.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\z8yw99.mkv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\z8yW99.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\z8yw99.mkv.ozq0")) returned 0 [0255.098] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\z8yW99.mkv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\z8yw99.mkv.ozq0")) returned 0x2020 [0255.098] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\z8yW99.mkv", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1f04ec00, ftCreationTime.dwHighDateTime=0x1d81c4f, ftLastAccessTime.dwLowDateTime=0xa1e690b0, ftLastAccessTime.dwHighDateTime=0x1d824f1, ftLastWriteTime.dwLowDateTime=0xa1e690b0, ftLastWriteTime.dwHighDateTime=0x1d824f1, nFileSizeHigh=0x0, nFileSizeLow=0x3144, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="z8yW99.mkv", cAlternateFileName="")) returned 0x275de0 [0255.099] FindNextFileA (in: hFindFile=0x275de0, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1f04ec00, ftCreationTime.dwHighDateTime=0x1d81c4f, ftLastAccessTime.dwLowDateTime=0xa1e690b0, ftLastAccessTime.dwHighDateTime=0x1d824f1, ftLastWriteTime.dwLowDateTime=0xa1e690b0, ftLastWriteTime.dwHighDateTime=0x1d824f1, nFileSizeHigh=0x0, nFileSizeLow=0x3144, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="z8yW99.mkv", cAlternateFileName="")) returned 0 [0255.099] FindClose (in: hFindFile=0x275de0 | out: hFindFile=0x275de0) returned 1 [0255.099] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\z8yW99.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\z8yw99.mkv")) returned 1 [0255.100] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\z8yW99.mkv" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\z8yw99.mkv")) returned 0xffffffff [0255.100] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2120, ftCreationTime.dwLowDateTime=0x5a63d000, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a63d000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a63d000, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="~DF1556BFD2B087CAC7.TMP", cAlternateFileName="~DF155~1.TMP")) returned 1 [0255.101] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1556BFD2B087CAC7.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1556bfd2b087cac7.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.101] CloseHandle (hObject=0xffffffff) returned 0 [0255.101] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1556BFD2B087CAC7.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1556bfd2b087cac7.tmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1556BFD2B087CAC7.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1556bfd2b087cac7.tmp.ozq0")) returned 1 [0255.102] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1556BFD2B087CAC7.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1556bfd2b087cac7.tmp.ozq0")) returned 0x2120 [0255.103] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1556BFD2B087CAC7.TMP", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="\x8c2Ä\x0143Ä\x01")) returned 0xffffffff [0255.103] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="\x8c2Ä\x0143Ä\x01")) returned 0 [0255.103] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0255.103] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1556BFD2B087CAC7.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1556bfd2b087cac7.tmp")) returned 0xffffffff [0255.103] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2120, ftCreationTime.dwLowDateTime=0x60195c40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60195c40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60195c40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="~DF1B75FE99498DD724.TMP", cAlternateFileName="~DF1B7~1.TMP")) returned 1 [0255.103] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1B75FE99498DD724.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1b75fe99498dd724.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.103] CloseHandle (hObject=0xffffffff) returned 0 [0255.103] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1B75FE99498DD724.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1b75fe99498dd724.tmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1B75FE99498DD724.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1b75fe99498dd724.tmp.ozq0")) returned 1 [0255.104] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1B75FE99498DD724.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1b75fe99498dd724.tmp.ozq0")) returned 0x2120 [0255.105] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1B75FE99498DD724.TMP", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="p3Ä\x01°2Ä\x01")) returned 0xffffffff [0255.105] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="p3Ä\x01°2Ä\x01")) returned 0 [0255.105] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0255.105] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF1B75FE99498DD724.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df1b75fe99498dd724.tmp")) returned 0xffffffff [0255.105] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x601e1f00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x601e1f00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60208060, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="~DF2D562DB8FF27C9D1.TMP", cAlternateFileName="~DF2D5~1.TMP")) returned 1 [0255.105] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF2D562DB8FF27C9D1.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df2d562db8ff27c9d1.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.105] CloseHandle (hObject=0xffffffff) returned 0 [0255.105] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF2D562DB8FF27C9D1.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df2d562db8ff27c9d1.tmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF2D562DB8FF27C9D1.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df2d562db8ff27c9d1.tmp.ozq0")) returned 1 [0255.106] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF2D562DB8FF27C9D1.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df2d562db8ff27c9d1.tmp.ozq0")) returned 0x2020 [0255.106] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF2D562DB8FF27C9D1.TMP", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="\x983Ä\x01L3Ä\x01")) returned 0xffffffff [0255.107] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="\x983Ä\x01L3Ä\x01")) returned 0 [0255.107] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0255.107] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF2D562DB8FF27C9D1.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df2d562db8ff27c9d1.tmp")) returned 0xffffffff [0255.107] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6016fae0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6016fae0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60195c40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="~DF41554412040D945E.TMP", cAlternateFileName="~DF415~1.TMP")) returned 1 [0255.107] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF41554412040D945E.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df41554412040d945e.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.107] CloseHandle (hObject=0xffffffff) returned 0 [0255.107] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF41554412040D945E.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df41554412040d945e.tmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF41554412040D945E.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df41554412040d945e.tmp.ozq0")) returned 1 [0255.108] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF41554412040D945E.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df41554412040d945e.tmp.ozq0")) returned 0x2020 [0255.108] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF41554412040D945E.TMP", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="p3Ä\x01")) returned 0xffffffff [0255.108] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="p3Ä\x01")) returned 0 [0255.108] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0255.108] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF41554412040D945E.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df41554412040d945e.tmp")) returned 0xffffffff [0255.108] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2120, ftCreationTime.dwLowDateTime=0x60208060, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60208060, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60208060, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x200, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="~DF4D08F994E18D5610.TMP", cAlternateFileName="~DF4D0~1.TMP")) returned 1 [0255.109] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF4D08F994E18D5610.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df4d08f994e18d5610.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.109] CloseHandle (hObject=0xffffffff) returned 0 [0255.109] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF4D08F994E18D5610.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df4d08f994e18d5610.tmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF4D08F994E18D5610.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df4d08f994e18d5610.tmp.ozq0")) returned 1 [0255.110] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF4D08F994E18D5610.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df4d08f994e18d5610.tmp.ozq0")) returned 0x2120 [0255.110] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF4D08F994E18D5610.TMP", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="\x983Ä\x01L3Ä\x01")) returned 0xffffffff [0255.110] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="\x983Ä\x01L3Ä\x01")) returned 0 [0255.110] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0255.110] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF4D08F994E18D5610.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df4d08f994e18d5610.tmp")) returned 0xffffffff [0255.110] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2120, ftCreationTime.dwLowDateTime=0x5a0e1e80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a0e1e80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a0e1e80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="~DF876D2693410EB316.TMP", cAlternateFileName="~DF876~1.TMP")) returned 1 [0255.110] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF876D2693410EB316.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df876d2693410eb316.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0255.110] CloseHandle (hObject=0xffffffff) returned 0 [0255.111] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF876D2693410EB316.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df876d2693410eb316.tmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF876D2693410EB316.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df876d2693410eb316.tmp.ozq0")) returned 1 [0255.111] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF876D2693410EB316.TMP.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df876d2693410eb316.tmp.ozq0")) returned 0x2120 [0255.112] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF876D2693410EB316.TMP", lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="p3Ä\x01")) returned 0xffffffff [0255.112] FindNextFileA (in: hFindFile=0xffffffff, lpFindFileData=0x18ef34 | out: lpFindFileData=0x18ef34*(dwFileAttributes=0x275e70, ftCreationTime.dwLowDateTime=0x2500c4, ftCreationTime.dwHighDateTime=0x26dd48, ftLastAccessTime.dwLowDateTime=0x3bf8, ftLastAccessTime.dwHighDateTime=0x250000, ftLastWriteTime.dwLowDateTime=0x80000000, ftLastWriteTime.dwHighDateTime=0x275dd8, nFileSizeHigh=0x18f040, nFileSizeLow=0x76f7389e, dwReserved0=0x250138, dwReserved1=0x76f7387a, cFileName="á!ev", cAlternateFileName="p3Ä\x01")) returned 0 [0255.112] FindClose (in: hFindFile=0xffffffff | out: hFindFile=0xffffffff) returned 0 [0255.112] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temp\\~DF876D2693410EB316.TMP" (normalized: "c:\\users\\keecfmwgj\\appdata\\local\\temp\\~df876d2693410eb316.tmp")) returned 0xffffffff [0255.112] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2120, ftCreationTime.dwLowDateTime=0x5a0e1e80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a0e1e80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a0e1e80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="~DF876D2693410EB316.TMP", cAlternateFileName="~DF876~1.TMP")) returned 0 [0255.112] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0255.112] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x79dbc710, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79dbc710, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x79dbc710, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x36313342, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0255.112] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\Temporary Internet Files\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2120, ftCreationTime.dwLowDateTime=0x5a0e1e80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x5a0e1e80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5a0e1e80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="~DF876D2693410EB316.TMP", cAlternateFileName="\x08Ý&")) returned 0xffffffff [0255.113] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b85dd30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7b85dd30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b85dd30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x36313342, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0255.113] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Local\\VirtualStore\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b85dd30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7b85dd30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b85dd30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dcb0 [0255.113] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b85dd30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7b85dd30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b85dd30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0255.113] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b85dd30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7b85dd30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b85dd30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 0 [0255.113] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0255.113] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7b85dd30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7b85dd30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7b85dd30, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x36313342, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0255.114] FindClose (in: hFindFile=0x26dd08 | out: hFindFile=0x26dd08) returned 1 [0255.114] FindNextFileA (in: hFindFile=0x26bbc0, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796723b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0255.114] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796723b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x36313342, cFileName=".", cAlternateFileName="")) returned 0x26dd08 [0255.114] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796723b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x36313342, cFileName="..", cAlternateFileName="")) returned 1 [0255.114] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x50fdc710, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x50fdc710, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x36313342, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0255.114] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x50fdc710, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x50fdc710, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName=".", cAlternateFileName="")) returned 0x26dcb0 [0255.114] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x50fdc710, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x50fdc710, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="..", cAlternateFileName="")) returned 1 [0255.114] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796723b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="CryptnetUrlCache", cAlternateFileName="CRYPTN~1")) returned 1 [0255.114] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796723b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0255.115] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796723b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0255.115] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18edd4, dwReserved1=0x76f73c74, cFileName="Content", cAlternateFileName="")) returned 1 [0255.115] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0255.115] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0255.116] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5d876470, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x5d876470, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x5d876470, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0x209, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0255.116] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xab8c1ed0, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0xab8c1ed0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xab8c1ed0, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x475, dwReserved0=0x300032, dwReserved1=0x380061, cFileName="37C951188967C8EB88D99893D9D191FE", cAlternateFileName="37C951~1")) returned 1 [0255.116] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x1aa3080, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x1aa3080, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x1aa3080, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x12bb, dwReserved0=0x620065, dwReserved1=0x380038, cFileName="57C8EDB95DF3F0AD4EE2DC2B8CFD4157", cAlternateFileName="57C8ED~1")) returned 1 [0255.116] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x794f7e10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x794f7e10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x794f7e10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x30d, dwReserved0=0x640061, dwReserved1=0x650034, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0255.116] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7c71ad70, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7c71ad70, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7c71ad70, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x234, dwReserved0=0x350038, dwReserved1=0x340062, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0255.117] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4eb51c0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x4eb51c0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x6a399090, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xe6fe, dwReserved0=0x640031, dwReserved1=0x390061, cFileName="77EC63BDA74BD0D0E0426DC8F8008506", cAlternateFileName="77EC63~1")) returned 1 [0255.117] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4e42da0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x300064, dwReserved1=0x300065, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0255.117] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x310066, dwReserved1=0x660066, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0255.117] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xaeb57250, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x436, dwReserved0=0x320034, dwReserved1=0x340065, cFileName="C0018BB1B5834735BFA60CD063B31956", cAlternateFileName="C0018B~1")) returned 1 [0255.117] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5a877f90, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x5a877f90, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x5a877f90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x5f1, dwReserved0=0x350033, dwReserved1=0x660062, cFileName="E34E75954A05FA2156EB895949C74728", cAlternateFileName="E34E75~1")) returned 1 [0255.117] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x310032, dwReserved1=0x360035, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0255.117] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7f963e30, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f963e30, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x310032, dwReserved1=0x360035, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0255.117] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0255.117] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="MetaData", cAlternateFileName="")) returned 1 [0255.117] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x340038, dwReserved1=0x310032, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x340038, dwReserved1=0x310032, cFileName="..", cAlternateFileName="")) returned 1 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5d876470, ftCreationTime.dwHighDateTime=0x1d706ad, ftLastAccessTime.dwLowDateTime=0x5d876470, ftLastAccessTime.dwHighDateTime=0x1d706ad, ftLastWriteTime.dwLowDateTime=0x6c7fca30, ftLastWriteTime.dwHighDateTime=0x1d706ad, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x340038, dwReserved1=0x310032, cFileName="3130B1871A126520A8C47861EFE3ED4D", cAlternateFileName="3130B1~1")) returned 1 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xab8c1ed0, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0xab8c1ed0, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xab8c1ed0, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x300032, dwReserved1=0x380061, cFileName="37C951188967C8EB88D99893D9D191FE", cAlternateFileName="37C951~1")) returned 1 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x1aa3080, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x1aa3080, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x293d1290, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x154, dwReserved0=0x620065, dwReserved1=0x380038, cFileName="57C8EDB95DF3F0AD4EE2DC2B8CFD4157", cAlternateFileName="57C8ED~1")) returned 1 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x794f7e10, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x794f7e10, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x794f7e10, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x640061, dwReserved1=0x650034, cFileName="696F3DE637E6DE85B458996D49D759AD", cAlternateFileName="696F3D~1")) returned 1 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7c71ad70, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7c71ad70, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7c71ad70, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x350038, dwReserved1=0x340062, cFileName="7396C420A8E1BC1DA97F1AF0D10BAD21", cAlternateFileName="7396C4~1")) returned 1 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x4eb51c0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x4eb51c0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x2948f970, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x148, dwReserved0=0x640031, dwReserved1=0x390061, cFileName="77EC63BDA74BD0D0E0426DC8F8008506", cAlternateFileName="77EC63~1")) returned 1 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4e42da0, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x300064, dwReserved1=0x300065, cFileName="7B2238AACCEDC3F1FFE8E7EB5F575EC9", cAlternateFileName="7B2238~1")) returned 1 [0255.118] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x23a43389, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x310066, dwReserved1=0x660066, cFileName="94308059B57B3142E455B38A6EB92015", cAlternateFileName="943080~1")) returned 1 [0255.119] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xaeb57250, ftCreationTime.dwHighDateTime=0x1d706ae, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x320034, dwReserved1=0x340065, cFileName="C0018BB1B5834735BFA60CD063B31956", cAlternateFileName="C0018B~1")) returned 1 [0255.119] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x5a877f90, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x5a877f90, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x5a877f90, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0xfa, dwReserved0=0x350033, dwReserved1=0x660062, cFileName="E34E75954A05FA2156EB895949C74728", cAlternateFileName="E34E75~1")) returned 1 [0255.119] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7f93dcd0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f93dcd0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x310032, dwReserved1=0x360035, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 1 [0255.119] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0x7f93dcd0, ftCreationTime.dwHighDateTime=0x1d706ab, ftLastAccessTime.dwLowDateTime=0x7f93dcd0, ftLastAccessTime.dwHighDateTime=0x1d706ab, ftLastWriteTime.dwLowDateTime=0x7f963e30, ftLastWriteTime.dwHighDateTime=0x1d706ab, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x310032, dwReserved1=0x360035, cFileName="F90F18257CBB4D84216AC1E1F3BB2C76", cAlternateFileName="F90F18~1")) returned 0 [0255.119] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0255.119] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xaeb57250, ftLastAccessTime.dwHighDateTime=0x1d706ae, ftLastWriteTime.dwLowDateTime=0xaeb57250, ftLastWriteTime.dwHighDateTime=0x1d706ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="MetaData", cAlternateFileName="")) returned 0 [0255.119] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0255.119] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50fdc710, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x50fdc710, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x50fdc710, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0255.119] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50fdc710, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x50fdc710, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x50fdc710, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0255.120] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50fdc710, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x50fdc710, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x50fdc710, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="..", cAlternateFileName="")) returned 1 [0255.120] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50fdc710, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x7525ca20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x7525ca20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Services", cAlternateFileName="")) returned 1 [0255.120] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50fdc710, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x7525ca20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x7525ca20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x340038, dwReserved1=0x310032, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0255.120] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50fdc710, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x7525ca20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x7525ca20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x340038, dwReserved1=0x310032, cFileName="..", cAlternateFileName="")) returned 1 [0255.120] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7525ca20, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x7525ca20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x7525ca20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x10be, dwReserved0=0x340038, dwReserved1=0x310032, cFileName="search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", cAlternateFileName="SEARCH~1.ICO")) returned 1 [0255.120] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" (normalized: "c:\\users\\keecfmwgj\\appdata\\locallow\\microsoft\\internet explorer\\services\\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0255.237] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\locallow\\microsoft\\internet explorer\\services\\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0255.238] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10be [0255.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0255.238] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0255.283] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10be, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x10be, lpOverlapped=0x0) returned 1 [0255.374] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x10c0, lpOverlapped=0x0) returned 1 [0255.375] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.435] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.447] CloseHandle (hObject=0xe8) returned 1 [0255.447] CloseHandle (hObject=0xe0) returned 1 [0255.447] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" (normalized: "c:\\users\\keecfmwgj\\appdata\\locallow\\microsoft\\internet explorer\\services\\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\locallow\\microsoft\\internet explorer\\services\\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.ozq0")) returned 0 [0255.448] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\locallow\\microsoft\\internet explorer\\services\\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.ozq0")) returned 0x2020 [0255.448] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7525ca20, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x7525ca20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x7525ca20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x10be, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", cAlternateFileName="SEARCH~1.ICO")) returned 0x277ef0 [0255.448] FindNextFileA (in: hFindFile=0x277ef0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7525ca20, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x7525ca20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x7525ca20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x10be, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", cAlternateFileName="SEARCH~1.ICO")) returned 0 [0255.448] FindClose (in: hFindFile=0x277ef0 | out: hFindFile=0x277ef0) returned 1 [0255.448] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" (normalized: "c:\\users\\keecfmwgj\\appdata\\locallow\\microsoft\\internet explorer\\services\\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico")) returned 1 [0255.449] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" (normalized: "c:\\users\\keecfmwgj\\appdata\\locallow\\microsoft\\internet explorer\\services\\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico")) returned 0xffffffff [0255.449] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7525ca20, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x7525ca20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x7525ca20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x10be, dwReserved0=0x340038, dwReserved1=0x310032, cFileName="search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico", cAlternateFileName="SEARCH~1.ICO")) returned 0 [0255.449] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0255.449] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50fdc710, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x7525ca20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x7525ca20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x38443442, dwReserved1=0x36313234, cFileName="Services", cAlternateFileName="")) returned 0 [0255.449] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0255.449] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50fdc710, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x50fdc710, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x50fdc710, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x766521e5, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 0 [0255.449] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0255.449] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796723b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x50fdc710, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x50fdc710, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x36313342, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0255.450] FindClose (in: hFindFile=0x26dd08 | out: hFindFile=0x26dd08) returned 1 [0255.450] FindNextFileA (in: hFindFile=0x26bbc0, lpFindFileData=0x18f790 | out: lpFindFileData=0x18f790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x5c6d1d20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5c6d1d20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72657465, dwReserved1=0x2074656e, cFileName="Roaming", cAlternateFileName="")) returned 1 [0255.450] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\*.*", lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x5c6d1d20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5c6d1d20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x36317265, cFileName=".", cAlternateFileName="")) returned 0x26dd08 [0255.450] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x5c6d1d20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x5c6d1d20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x726f6c70, dwReserved1=0x36317265, cFileName="..", cAlternateFileName="")) returned 1 [0255.450] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x761335c0, ftCreationTime.dwHighDateTime=0x1d81a3c, ftLastAccessTime.dwLowDateTime=0x22d0a920, ftLastAccessTime.dwHighDateTime=0x1d828c8, ftLastWriteTime.dwLowDateTime=0x22d0a920, ftLastWriteTime.dwHighDateTime=0x1d828c8, nFileSizeHigh=0x0, nFileSizeLow=0x17717, dwReserved0=0x726f6c70, dwReserved1=0x36317265, cFileName="13RY54M_tNG.docx", cAlternateFileName="13RY54~1.DOC")) returned 1 [0255.450] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\13RY54M_tNG.docx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\13ry54m_tng.docx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.451] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\13RY54M_tNG.docx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\13ry54m_tng.docx.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.451] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17717 [0255.452] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0255.452] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0255.494] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x17717, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x17717, lpOverlapped=0x0) returned 1 [0255.496] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17720, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x17720, lpOverlapped=0x0) returned 1 [0255.498] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.558] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.571] CloseHandle (hObject=0xf0) returned 1 [0255.571] CloseHandle (hObject=0xec) returned 1 [0255.571] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\13RY54M_tNG.docx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\13ry54m_tng.docx"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\13RY54M_tNG.docx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\13ry54m_tng.docx.ozq0")) returned 0 [0255.572] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\13RY54M_tNG.docx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\13ry54m_tng.docx.ozq0")) returned 0x2020 [0255.572] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\13RY54M_tNG.docx", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x761335c0, ftCreationTime.dwHighDateTime=0x1d81a3c, ftLastAccessTime.dwLowDateTime=0x22d0a920, ftLastAccessTime.dwHighDateTime=0x1d828c8, ftLastWriteTime.dwLowDateTime=0x22d0a920, ftLastWriteTime.dwHighDateTime=0x1d828c8, nFileSizeHigh=0x0, nFileSizeLow=0x17717, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="13RY54M_tNG.docx", cAlternateFileName="13RY54~1.DOC")) returned 0x26dcb0 [0255.572] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x761335c0, ftCreationTime.dwHighDateTime=0x1d81a3c, ftLastAccessTime.dwLowDateTime=0x22d0a920, ftLastAccessTime.dwHighDateTime=0x1d828c8, ftLastWriteTime.dwLowDateTime=0x22d0a920, ftLastWriteTime.dwHighDateTime=0x1d828c8, nFileSizeHigh=0x0, nFileSizeLow=0x17717, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="13RY54M_tNG.docx", cAlternateFileName="13RY54~1.DOC")) returned 0 [0255.572] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0255.572] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\13RY54M_tNG.docx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\13ry54m_tng.docx")) returned 1 [0255.575] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\13RY54M_tNG.docx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\13ry54m_tng.docx")) returned 0xffffffff [0255.575] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b6b9aa0, ftCreationTime.dwHighDateTime=0x1d82205, ftLastAccessTime.dwLowDateTime=0xc80c05d0, ftLastAccessTime.dwHighDateTime=0x1d822d1, ftLastWriteTime.dwLowDateTime=0xc80c05d0, ftLastWriteTime.dwHighDateTime=0x1d822d1, nFileSizeHigh=0x0, nFileSizeLow=0xf29a, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="2b_QZ-yDJY0qlOt2QM.bmp", cAlternateFileName="2B_QZ-~1.BMP")) returned 1 [0255.576] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2b_QZ-yDJY0qlOt2QM.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2b_qz-ydjy0qlot2qm.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.576] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2b_QZ-yDJY0qlOt2QM.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2b_qz-ydjy0qlot2qm.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.577] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf29a [0255.577] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0255.577] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0255.621] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf29a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xf29a, lpOverlapped=0x0) returned 1 [0255.623] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf2a0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xf2a0, lpOverlapped=0x0) returned 1 [0255.625] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.684] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.698] CloseHandle (hObject=0xec) returned 1 [0255.699] CloseHandle (hObject=0xf0) returned 1 [0255.699] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2b_QZ-yDJY0qlOt2QM.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2b_qz-ydjy0qlot2qm.bmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2b_QZ-yDJY0qlOt2QM.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2b_qz-ydjy0qlot2qm.bmp.ozq0")) returned 0 [0255.699] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2b_QZ-yDJY0qlOt2QM.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2b_qz-ydjy0qlot2qm.bmp.ozq0")) returned 0x2020 [0255.700] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2b_QZ-yDJY0qlOt2QM.bmp", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b6b9aa0, ftCreationTime.dwHighDateTime=0x1d82205, ftLastAccessTime.dwLowDateTime=0xc80c05d0, ftLastAccessTime.dwHighDateTime=0x1d822d1, ftLastWriteTime.dwLowDateTime=0xc80c05d0, ftLastWriteTime.dwHighDateTime=0x1d822d1, nFileSizeHigh=0x0, nFileSizeLow=0xf29a, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2b_QZ-yDJY0qlOt2QM.bmp", cAlternateFileName="2B_QZ-~1.BMP")) returned 0x26dcb0 [0255.700] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b6b9aa0, ftCreationTime.dwHighDateTime=0x1d82205, ftLastAccessTime.dwLowDateTime=0xc80c05d0, ftLastAccessTime.dwHighDateTime=0x1d822d1, ftLastWriteTime.dwLowDateTime=0xc80c05d0, ftLastWriteTime.dwHighDateTime=0x1d822d1, nFileSizeHigh=0x0, nFileSizeLow=0xf29a, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2b_QZ-yDJY0qlOt2QM.bmp", cAlternateFileName="2B_QZ-~1.BMP")) returned 0 [0255.700] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0255.700] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2b_QZ-yDJY0qlOt2QM.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2b_qz-ydjy0qlot2qm.bmp")) returned 1 [0255.702] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2b_QZ-yDJY0qlOt2QM.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2b_qz-ydjy0qlot2qm.bmp")) returned 0xffffffff [0255.702] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x979512e0, ftCreationTime.dwHighDateTime=0x1d828c4, ftLastAccessTime.dwLowDateTime=0x93833a70, ftLastAccessTime.dwHighDateTime=0x1d82990, ftLastWriteTime.dwLowDateTime=0x93833a70, ftLastWriteTime.dwHighDateTime=0x1d82990, nFileSizeHigh=0x0, nFileSizeLow=0xc29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="2j_115.jpg", cAlternateFileName="")) returned 1 [0255.702] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2j_115.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2j_115.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.702] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2j_115.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2j_115.jpg.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.703] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xc29a [0255.703] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0255.703] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0255.753] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xc29a, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xc29a, lpOverlapped=0x0) returned 1 [0255.755] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xc2a0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xc2a0, lpOverlapped=0x0) returned 1 [0255.757] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.818] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.829] CloseHandle (hObject=0xf0) returned 1 [0255.829] CloseHandle (hObject=0xec) returned 1 [0255.829] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2j_115.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2j_115.jpg"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2j_115.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2j_115.jpg.ozq0")) returned 0 [0255.830] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2j_115.jpg.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2j_115.jpg.ozq0")) returned 0x2020 [0255.830] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2j_115.jpg", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x979512e0, ftCreationTime.dwHighDateTime=0x1d828c4, ftLastAccessTime.dwLowDateTime=0x93833a70, ftLastAccessTime.dwHighDateTime=0x1d82990, ftLastWriteTime.dwLowDateTime=0x93833a70, ftLastWriteTime.dwHighDateTime=0x1d82990, nFileSizeHigh=0x0, nFileSizeLow=0xc29a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="2j_115.jpg", cAlternateFileName="")) returned 0x26dcb0 [0255.830] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x979512e0, ftCreationTime.dwHighDateTime=0x1d828c4, ftLastAccessTime.dwLowDateTime=0x93833a70, ftLastAccessTime.dwHighDateTime=0x1d82990, ftLastWriteTime.dwLowDateTime=0x93833a70, ftLastWriteTime.dwHighDateTime=0x1d82990, nFileSizeHigh=0x0, nFileSizeLow=0xc29a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="2j_115.jpg", cAlternateFileName="")) returned 0 [0255.831] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0255.831] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2j_115.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2j_115.jpg")) returned 1 [0255.833] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\2j_115.jpg" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\2j_115.jpg")) returned 0xffffffff [0255.833] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae68eb60, ftCreationTime.dwHighDateTime=0x1d82296, ftLastAccessTime.dwLowDateTime=0x67d3ff60, ftLastAccessTime.dwHighDateTime=0x1d825d8, ftLastWriteTime.dwLowDateTime=0x67d3ff60, ftLastWriteTime.dwHighDateTime=0x1d825d8, nFileSizeHigh=0x0, nFileSizeLow=0x4f5f, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="5toMN0.m4a", cAlternateFileName="")) returned 1 [0255.833] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\5toMN0.m4a" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\5tomn0.m4a"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.833] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\5toMN0.m4a.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\5tomn0.m4a.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.834] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f5f [0255.834] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0255.834] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0255.884] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f5f, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x4f5f, lpOverlapped=0x0) returned 1 [0255.885] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4f60, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x4f60, lpOverlapped=0x0) returned 1 [0255.886] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0255.944] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0255.956] CloseHandle (hObject=0xec) returned 1 [0255.956] CloseHandle (hObject=0xf0) returned 1 [0255.956] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\5toMN0.m4a" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\5tomn0.m4a"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\5toMN0.m4a.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\5tomn0.m4a.ozq0")) returned 0 [0255.957] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\5toMN0.m4a.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\5tomn0.m4a.ozq0")) returned 0x2020 [0255.957] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\5toMN0.m4a", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae68eb60, ftCreationTime.dwHighDateTime=0x1d82296, ftLastAccessTime.dwLowDateTime=0x67d3ff60, ftLastAccessTime.dwHighDateTime=0x1d825d8, ftLastWriteTime.dwLowDateTime=0x67d3ff60, ftLastWriteTime.dwHighDateTime=0x1d825d8, nFileSizeHigh=0x0, nFileSizeLow=0x4f5f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="5toMN0.m4a", cAlternateFileName="")) returned 0x26dcb0 [0255.957] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xae68eb60, ftCreationTime.dwHighDateTime=0x1d82296, ftLastAccessTime.dwLowDateTime=0x67d3ff60, ftLastAccessTime.dwHighDateTime=0x1d825d8, ftLastWriteTime.dwLowDateTime=0x67d3ff60, ftLastWriteTime.dwHighDateTime=0x1d825d8, nFileSizeHigh=0x0, nFileSizeLow=0x4f5f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="5toMN0.m4a", cAlternateFileName="")) returned 0 [0255.957] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0255.957] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\5toMN0.m4a" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\5tomn0.m4a")) returned 1 [0255.959] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\5toMN0.m4a" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\5tomn0.m4a")) returned 0xffffffff [0255.959] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe15dee0, ftCreationTime.dwHighDateTime=0x1d81db2, ftLastAccessTime.dwLowDateTime=0x7bf3d160, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0x7bf3d160, ftLastWriteTime.dwHighDateTime=0x1d8282f, nFileSizeHigh=0x0, nFileSizeLow=0x17de6, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="aM63xM3LuAEGP v-Io.flv", cAlternateFileName="AM63XM~1.FLV")) returned 1 [0255.959] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aM63xM3LuAEGP v-Io.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\am63xm3luaegp v-io.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0255.959] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aM63xM3LuAEGP v-Io.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\am63xm3luaegp v-io.flv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0255.960] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17de6 [0255.960] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0255.960] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0256.009] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x17de6, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x17de6, lpOverlapped=0x0) returned 1 [0256.011] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17df0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x17df0, lpOverlapped=0x0) returned 1 [0256.014] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.084] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.095] CloseHandle (hObject=0xf0) returned 1 [0256.095] CloseHandle (hObject=0xec) returned 1 [0256.096] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aM63xM3LuAEGP v-Io.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\am63xm3luaegp v-io.flv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aM63xM3LuAEGP v-Io.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\am63xm3luaegp v-io.flv.ozq0")) returned 0 [0256.096] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aM63xM3LuAEGP v-Io.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\am63xm3luaegp v-io.flv.ozq0")) returned 0x2020 [0256.097] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aM63xM3LuAEGP v-Io.flv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe15dee0, ftCreationTime.dwHighDateTime=0x1d81db2, ftLastAccessTime.dwLowDateTime=0x7bf3d160, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0x7bf3d160, ftLastWriteTime.dwHighDateTime=0x1d8282f, nFileSizeHigh=0x0, nFileSizeLow=0x17de6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="aM63xM3LuAEGP v-Io.flv", cAlternateFileName="AM63XM~1.FLV")) returned 0x26dcb0 [0256.097] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe15dee0, ftCreationTime.dwHighDateTime=0x1d81db2, ftLastAccessTime.dwLowDateTime=0x7bf3d160, ftLastAccessTime.dwHighDateTime=0x1d8282f, ftLastWriteTime.dwLowDateTime=0x7bf3d160, ftLastWriteTime.dwHighDateTime=0x1d8282f, nFileSizeHigh=0x0, nFileSizeLow=0x17de6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="aM63xM3LuAEGP v-Io.flv", cAlternateFileName="AM63XM~1.FLV")) returned 0 [0256.097] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0256.097] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aM63xM3LuAEGP v-Io.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\am63xm3luaegp v-io.flv")) returned 1 [0256.108] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aM63xM3LuAEGP v-Io.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\am63xm3luaegp v-io.flv")) returned 0xffffffff [0256.108] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2d3a080, ftCreationTime.dwHighDateTime=0x1d82720, ftLastAccessTime.dwLowDateTime=0xd4b02fb0, ftLastAccessTime.dwHighDateTime=0x1d82721, ftLastWriteTime.dwLowDateTime=0xd4b02fb0, ftLastWriteTime.dwHighDateTime=0x1d82721, nFileSizeHigh=0x0, nFileSizeLow=0xdf2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="aTdaAFT.avi", cAlternateFileName="")) returned 1 [0256.109] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aTdaAFT.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atdaaft.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.109] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aTdaAFT.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atdaaft.avi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.110] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf2c [0256.110] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0256.110] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0256.155] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdf2c, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xdf2c, lpOverlapped=0x0) returned 1 [0256.157] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xdf30, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xdf30, lpOverlapped=0x0) returned 1 [0256.159] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.221] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.232] CloseHandle (hObject=0xec) returned 1 [0256.232] CloseHandle (hObject=0xf0) returned 1 [0256.233] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aTdaAFT.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atdaaft.avi"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aTdaAFT.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atdaaft.avi.ozq0")) returned 0 [0256.233] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aTdaAFT.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atdaaft.avi.ozq0")) returned 0x2020 [0256.233] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aTdaAFT.avi", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2d3a080, ftCreationTime.dwHighDateTime=0x1d82720, ftLastAccessTime.dwLowDateTime=0xd4b02fb0, ftLastAccessTime.dwHighDateTime=0x1d82721, ftLastWriteTime.dwLowDateTime=0xd4b02fb0, ftLastWriteTime.dwHighDateTime=0x1d82721, nFileSizeHigh=0x0, nFileSizeLow=0xdf2c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="aTdaAFT.avi", cAlternateFileName="")) returned 0x26dcb0 [0256.234] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb2d3a080, ftCreationTime.dwHighDateTime=0x1d82720, ftLastAccessTime.dwLowDateTime=0xd4b02fb0, ftLastAccessTime.dwHighDateTime=0x1d82721, ftLastWriteTime.dwLowDateTime=0xd4b02fb0, ftLastWriteTime.dwHighDateTime=0x1d82721, nFileSizeHigh=0x0, nFileSizeLow=0xdf2c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="aTdaAFT.avi", cAlternateFileName="")) returned 0 [0256.234] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0256.234] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aTdaAFT.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atdaaft.avi")) returned 1 [0256.235] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\aTdaAFT.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\atdaaft.avi")) returned 0xffffffff [0256.235] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd9f6950, ftCreationTime.dwHighDateTime=0x1d81eb7, ftLastAccessTime.dwLowDateTime=0xe8db8a80, ftLastAccessTime.dwHighDateTime=0x1d81fa0, ftLastWriteTime.dwLowDateTime=0xe8db8a80, ftLastWriteTime.dwHighDateTime=0x1d81fa0, nFileSizeHigh=0x0, nFileSizeLow=0x6126, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="ba1W8yC6Ur XifoqHC6.avi", cAlternateFileName="BA1W8Y~1.AVI")) returned 1 [0256.235] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ba1W8yC6Ur XifoqHC6.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ba1w8yc6ur xifoqhc6.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.236] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ba1W8yC6Ur XifoqHC6.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ba1w8yc6ur xifoqhc6.avi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.236] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x6126 [0256.236] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0256.237] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0256.282] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x6126, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x6126, lpOverlapped=0x0) returned 1 [0256.283] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6130, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6130, lpOverlapped=0x0) returned 1 [0256.284] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.344] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.355] CloseHandle (hObject=0xf0) returned 1 [0256.356] CloseHandle (hObject=0xec) returned 1 [0256.356] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ba1W8yC6Ur XifoqHC6.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ba1w8yc6ur xifoqhc6.avi"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ba1W8yC6Ur XifoqHC6.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ba1w8yc6ur xifoqhc6.avi.ozq0")) returned 0 [0256.356] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ba1W8yC6Ur XifoqHC6.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ba1w8yc6ur xifoqhc6.avi.ozq0")) returned 0x2020 [0256.356] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ba1W8yC6Ur XifoqHC6.avi", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd9f6950, ftCreationTime.dwHighDateTime=0x1d81eb7, ftLastAccessTime.dwLowDateTime=0xe8db8a80, ftLastAccessTime.dwHighDateTime=0x1d81fa0, ftLastWriteTime.dwLowDateTime=0xe8db8a80, ftLastWriteTime.dwHighDateTime=0x1d81fa0, nFileSizeHigh=0x0, nFileSizeLow=0x6126, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ba1W8yC6Ur XifoqHC6.avi", cAlternateFileName="BA1W8Y~1.AVI")) returned 0x26dcb0 [0256.357] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xdd9f6950, ftCreationTime.dwHighDateTime=0x1d81eb7, ftLastAccessTime.dwLowDateTime=0xe8db8a80, ftLastAccessTime.dwHighDateTime=0x1d81fa0, ftLastWriteTime.dwLowDateTime=0xe8db8a80, ftLastWriteTime.dwHighDateTime=0x1d81fa0, nFileSizeHigh=0x0, nFileSizeLow=0x6126, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ba1W8yC6Ur XifoqHC6.avi", cAlternateFileName="BA1W8Y~1.AVI")) returned 0 [0256.357] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0256.357] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ba1W8yC6Ur XifoqHC6.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ba1w8yc6ur xifoqhc6.avi")) returned 1 [0256.358] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ba1W8yC6Ur XifoqHC6.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ba1w8yc6ur xifoqhc6.avi")) returned 0xffffffff [0256.358] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec01a840, ftCreationTime.dwHighDateTime=0x1d82296, ftLastAccessTime.dwLowDateTime=0x26a62200, ftLastAccessTime.dwHighDateTime=0x1d82521, ftLastWriteTime.dwLowDateTime=0x26a62200, ftLastWriteTime.dwHighDateTime=0x1d82521, nFileSizeHigh=0x0, nFileSizeLow=0x11fb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DlBTBgX992VmvKI.swf", cAlternateFileName="DLBTBG~1.SWF")) returned 1 [0256.358] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DlBTBgX992VmvKI.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dlbtbgx992vmvki.swf"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.358] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DlBTBgX992VmvKI.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dlbtbgx992vmvki.swf.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.359] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11fb9 [0256.359] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0256.360] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0256.405] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11fb9, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x11fb9, lpOverlapped=0x0) returned 1 [0256.406] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x11fc0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x11fc0, lpOverlapped=0x0) returned 1 [0256.408] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.465] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.477] CloseHandle (hObject=0xec) returned 1 [0256.477] CloseHandle (hObject=0xf0) returned 1 [0256.477] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DlBTBgX992VmvKI.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dlbtbgx992vmvki.swf"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DlBTBgX992VmvKI.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dlbtbgx992vmvki.swf.ozq0")) returned 0 [0256.478] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DlBTBgX992VmvKI.swf.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dlbtbgx992vmvki.swf.ozq0")) returned 0x2020 [0256.478] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DlBTBgX992VmvKI.swf", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec01a840, ftCreationTime.dwHighDateTime=0x1d82296, ftLastAccessTime.dwLowDateTime=0x26a62200, ftLastAccessTime.dwHighDateTime=0x1d82521, ftLastWriteTime.dwLowDateTime=0x26a62200, ftLastWriteTime.dwHighDateTime=0x1d82521, nFileSizeHigh=0x0, nFileSizeLow=0x11fb9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="DlBTBgX992VmvKI.swf", cAlternateFileName="DLBTBG~1.SWF")) returned 0x26dcb0 [0256.479] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec01a840, ftCreationTime.dwHighDateTime=0x1d82296, ftLastAccessTime.dwLowDateTime=0x26a62200, ftLastAccessTime.dwHighDateTime=0x1d82521, ftLastWriteTime.dwLowDateTime=0x26a62200, ftLastWriteTime.dwHighDateTime=0x1d82521, nFileSizeHigh=0x0, nFileSizeLow=0x11fb9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="DlBTBgX992VmvKI.swf", cAlternateFileName="DLBTBG~1.SWF")) returned 0 [0256.479] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0256.479] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DlBTBgX992VmvKI.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dlbtbgx992vmvki.swf")) returned 1 [0256.480] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DlBTBgX992VmvKI.swf" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dlbtbgx992vmvki.swf")) returned 0xffffffff [0256.480] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d264d60, ftCreationTime.dwHighDateTime=0x1d825d8, ftLastAccessTime.dwLowDateTime=0xb09e2a30, ftLastAccessTime.dwHighDateTime=0x1d827e1, ftLastWriteTime.dwLowDateTime=0xb09e2a30, ftLastWriteTime.dwHighDateTime=0x1d827e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWVVZCJ.png", cAlternateFileName="")) returned 1 [0256.481] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DWVVZCJ.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dwvvzcj.png"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.481] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DWVVZCJ.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dwvvzcj.png.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.482] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xaf4d [0256.482] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0256.482] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0256.529] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xaf4d, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xaf4d, lpOverlapped=0x0) returned 1 [0256.531] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xaf50, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xaf50, lpOverlapped=0x0) returned 1 [0256.533] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.603] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.616] CloseHandle (hObject=0xf0) returned 1 [0256.616] CloseHandle (hObject=0xec) returned 1 [0256.616] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DWVVZCJ.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dwvvzcj.png"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DWVVZCJ.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dwvvzcj.png.ozq0")) returned 0 [0256.617] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DWVVZCJ.png.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dwvvzcj.png.ozq0")) returned 0x2020 [0256.617] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DWVVZCJ.png", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d264d60, ftCreationTime.dwHighDateTime=0x1d825d8, ftLastAccessTime.dwLowDateTime=0xb09e2a30, ftLastAccessTime.dwHighDateTime=0x1d827e1, ftLastWriteTime.dwLowDateTime=0xb09e2a30, ftLastWriteTime.dwHighDateTime=0x1d827e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf4d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="DWVVZCJ.png", cAlternateFileName="")) returned 0x26dcb0 [0256.617] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d264d60, ftCreationTime.dwHighDateTime=0x1d825d8, ftLastAccessTime.dwLowDateTime=0xb09e2a30, ftLastAccessTime.dwHighDateTime=0x1d827e1, ftLastWriteTime.dwLowDateTime=0xb09e2a30, ftLastWriteTime.dwHighDateTime=0x1d827e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf4d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="DWVVZCJ.png", cAlternateFileName="")) returned 0 [0256.617] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0256.617] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DWVVZCJ.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dwvvzcj.png")) returned 1 [0256.620] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\DWVVZCJ.png" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\dwvvzcj.png")) returned 0xffffffff [0256.620] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e47960, ftCreationTime.dwHighDateTime=0x1d828bf, ftLastAccessTime.dwLowDateTime=0xc70742b0, ftLastAccessTime.dwHighDateTime=0x1d828f5, ftLastWriteTime.dwLowDateTime=0xc70742b0, ftLastWriteTime.dwHighDateTime=0x1d828f5, nFileSizeHigh=0x0, nFileSizeLow=0x651c, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="EHxjayv_.avi", cAlternateFileName="")) returned 1 [0256.621] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\EHxjayv_.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ehxjayv_.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.621] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\EHxjayv_.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ehxjayv_.avi.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.622] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x651c [0256.622] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0256.622] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0256.674] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x651c, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x651c, lpOverlapped=0x0) returned 1 [0256.677] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x6520, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x6520, lpOverlapped=0x0) returned 1 [0256.679] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.737] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.749] CloseHandle (hObject=0xec) returned 1 [0256.749] CloseHandle (hObject=0xf0) returned 1 [0256.749] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\EHxjayv_.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ehxjayv_.avi"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\EHxjayv_.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ehxjayv_.avi.ozq0")) returned 0 [0256.750] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\EHxjayv_.avi.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ehxjayv_.avi.ozq0")) returned 0x2020 [0256.750] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\EHxjayv_.avi", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e47960, ftCreationTime.dwHighDateTime=0x1d828bf, ftLastAccessTime.dwLowDateTime=0xc70742b0, ftLastAccessTime.dwHighDateTime=0x1d828f5, ftLastWriteTime.dwLowDateTime=0xc70742b0, ftLastWriteTime.dwHighDateTime=0x1d828f5, nFileSizeHigh=0x0, nFileSizeLow=0x651c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="EHxjayv_.avi", cAlternateFileName="")) returned 0x26dcb0 [0256.750] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x84e47960, ftCreationTime.dwHighDateTime=0x1d828bf, ftLastAccessTime.dwLowDateTime=0xc70742b0, ftLastAccessTime.dwHighDateTime=0x1d828f5, ftLastWriteTime.dwLowDateTime=0xc70742b0, ftLastWriteTime.dwHighDateTime=0x1d828f5, nFileSizeHigh=0x0, nFileSizeLow=0x651c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="EHxjayv_.avi", cAlternateFileName="")) returned 0 [0256.750] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0256.750] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\EHxjayv_.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ehxjayv_.avi")) returned 1 [0256.752] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\EHxjayv_.avi" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\ehxjayv_.avi")) returned 0xffffffff [0256.752] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfaee18e0, ftCreationTime.dwHighDateTime=0x1d81c7c, ftLastAccessTime.dwLowDateTime=0x6e409390, ftLastAccessTime.dwHighDateTime=0x1d82191, ftLastWriteTime.dwLowDateTime=0x6e409390, ftLastWriteTime.dwHighDateTime=0x1d82191, nFileSizeHigh=0x0, nFileSizeLow=0x2811, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="ELMx692tnTbVJWG.wav", cAlternateFileName="ELMX69~1.WAV")) returned 1 [0256.752] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ELMx692tnTbVJWG.wav" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\elmx692tntbvjwg.wav"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.752] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ELMx692tnTbVJWG.wav.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\elmx692tntbvjwg.wav.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.753] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2811 [0256.753] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0256.754] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0256.804] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2811, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x2811, lpOverlapped=0x0) returned 1 [0256.805] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2820, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x2820, lpOverlapped=0x0) returned 1 [0256.806] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0256.870] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0256.889] CloseHandle (hObject=0xf0) returned 1 [0256.889] CloseHandle (hObject=0xec) returned 1 [0256.890] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ELMx692tnTbVJWG.wav" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\elmx692tntbvjwg.wav"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ELMx692tnTbVJWG.wav.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\elmx692tntbvjwg.wav.ozq0")) returned 0 [0256.890] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ELMx692tnTbVJWG.wav.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\elmx692tntbvjwg.wav.ozq0")) returned 0x2020 [0256.890] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ELMx692tnTbVJWG.wav", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfaee18e0, ftCreationTime.dwHighDateTime=0x1d81c7c, ftLastAccessTime.dwLowDateTime=0x6e409390, ftLastAccessTime.dwHighDateTime=0x1d82191, ftLastWriteTime.dwLowDateTime=0x6e409390, ftLastWriteTime.dwHighDateTime=0x1d82191, nFileSizeHigh=0x0, nFileSizeLow=0x2811, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ELMx692tnTbVJWG.wav", cAlternateFileName="ELMX69~1.WAV")) returned 0x26dcb0 [0256.891] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfaee18e0, ftCreationTime.dwHighDateTime=0x1d81c7c, ftLastAccessTime.dwLowDateTime=0x6e409390, ftLastAccessTime.dwHighDateTime=0x1d82191, ftLastWriteTime.dwLowDateTime=0x6e409390, ftLastWriteTime.dwHighDateTime=0x1d82191, nFileSizeHigh=0x0, nFileSizeLow=0x2811, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ELMx692tnTbVJWG.wav", cAlternateFileName="ELMX69~1.WAV")) returned 0 [0256.891] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0256.891] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ELMx692tnTbVJWG.wav" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\elmx692tntbvjwg.wav")) returned 1 [0256.892] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\ELMx692tnTbVJWG.wav" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\elmx692tntbvjwg.wav")) returned 0xffffffff [0256.892] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c87a890, ftCreationTime.dwHighDateTime=0x1d81fd4, ftLastAccessTime.dwLowDateTime=0xbcc5f0c0, ftLastAccessTime.dwHighDateTime=0x1d82270, ftLastWriteTime.dwLowDateTime=0xbcc5f0c0, ftLastWriteTime.dwHighDateTime=0x1d82270, nFileSizeHigh=0x0, nFileSizeLow=0x10aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="FahWdm46t.flv", cAlternateFileName="FAHWDM~1.FLV")) returned 1 [0256.892] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FahWdm46t.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\fahwdm46t.flv"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0256.892] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FahWdm46t.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\fahwdm46t.flv.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0256.893] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10aa2 [0256.893] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0256.894] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0256.951] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10aa2, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x10aa2, lpOverlapped=0x0) returned 1 [0256.953] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x10ab0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x10ab0, lpOverlapped=0x0) returned 1 [0256.955] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.023] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.040] CloseHandle (hObject=0xec) returned 1 [0257.040] CloseHandle (hObject=0xf0) returned 1 [0257.040] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FahWdm46t.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\fahwdm46t.flv"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FahWdm46t.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\fahwdm46t.flv.ozq0")) returned 0 [0257.041] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FahWdm46t.flv.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\fahwdm46t.flv.ozq0")) returned 0x2020 [0257.041] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FahWdm46t.flv", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c87a890, ftCreationTime.dwHighDateTime=0x1d81fd4, ftLastAccessTime.dwLowDateTime=0xbcc5f0c0, ftLastAccessTime.dwHighDateTime=0x1d82270, ftLastWriteTime.dwLowDateTime=0xbcc5f0c0, ftLastWriteTime.dwHighDateTime=0x1d82270, nFileSizeHigh=0x0, nFileSizeLow=0x10aa2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FahWdm46t.flv", cAlternateFileName="FAHWDM~1.FLV")) returned 0x26dcb0 [0257.041] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c87a890, ftCreationTime.dwHighDateTime=0x1d81fd4, ftLastAccessTime.dwLowDateTime=0xbcc5f0c0, ftLastAccessTime.dwHighDateTime=0x1d82270, ftLastWriteTime.dwLowDateTime=0xbcc5f0c0, ftLastWriteTime.dwHighDateTime=0x1d82270, nFileSizeHigh=0x0, nFileSizeLow=0x10aa2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="FahWdm46t.flv", cAlternateFileName="FAHWDM~1.FLV")) returned 0 [0257.041] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0257.041] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FahWdm46t.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\fahwdm46t.flv")) returned 1 [0257.043] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\FahWdm46t.flv" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\fahwdm46t.flv")) returned 0xffffffff [0257.043] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x883c16d0, ftCreationTime.dwHighDateTime=0x1d82343, ftLastAccessTime.dwLowDateTime=0x1ea8f4c0, ftLastAccessTime.dwHighDateTime=0x1d82a02, ftLastWriteTime.dwLowDateTime=0x1ea8f4c0, ftLastWriteTime.dwHighDateTime=0x1d82a02, nFileSizeHigh=0x0, nFileSizeLow=0x78de, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="G2Y3bwebNDJ9bDD7G.xlsx", cAlternateFileName="G2Y3BW~1.XLS")) returned 1 [0257.044] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\G2Y3bwebNDJ9bDD7G.xlsx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\g2y3bwebndj9bdd7g.xlsx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0257.044] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\G2Y3bwebNDJ9bDD7G.xlsx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\g2y3bwebndj9bdd7g.xlsx.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.044] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x78de [0257.045] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0257.045] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0257.102] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x78de, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x78de, lpOverlapped=0x0) returned 1 [0257.103] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x78e0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x78e0, lpOverlapped=0x0) returned 1 [0257.105] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.169] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.181] CloseHandle (hObject=0xf0) returned 1 [0257.181] CloseHandle (hObject=0xec) returned 1 [0257.181] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\G2Y3bwebNDJ9bDD7G.xlsx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\g2y3bwebndj9bdd7g.xlsx"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\G2Y3bwebNDJ9bDD7G.xlsx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\g2y3bwebndj9bdd7g.xlsx.ozq0")) returned 0 [0257.182] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\G2Y3bwebNDJ9bDD7G.xlsx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\g2y3bwebndj9bdd7g.xlsx.ozq0")) returned 0x2020 [0257.182] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\G2Y3bwebNDJ9bDD7G.xlsx", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x883c16d0, ftCreationTime.dwHighDateTime=0x1d82343, ftLastAccessTime.dwLowDateTime=0x1ea8f4c0, ftLastAccessTime.dwHighDateTime=0x1d82a02, ftLastWriteTime.dwLowDateTime=0x1ea8f4c0, ftLastWriteTime.dwHighDateTime=0x1d82a02, nFileSizeHigh=0x0, nFileSizeLow=0x78de, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="G2Y3bwebNDJ9bDD7G.xlsx", cAlternateFileName="G2Y3BW~1.XLS")) returned 0x26dcb0 [0257.182] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x883c16d0, ftCreationTime.dwHighDateTime=0x1d82343, ftLastAccessTime.dwLowDateTime=0x1ea8f4c0, ftLastAccessTime.dwHighDateTime=0x1d82a02, ftLastWriteTime.dwLowDateTime=0x1ea8f4c0, ftLastWriteTime.dwHighDateTime=0x1d82a02, nFileSizeHigh=0x0, nFileSizeLow=0x78de, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="G2Y3bwebNDJ9bDD7G.xlsx", cAlternateFileName="G2Y3BW~1.XLS")) returned 0 [0257.182] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0257.182] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\G2Y3bwebNDJ9bDD7G.xlsx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\g2y3bwebndj9bdd7g.xlsx")) returned 1 [0257.183] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\G2Y3bwebNDJ9bDD7G.xlsx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\g2y3bwebndj9bdd7g.xlsx")) returned 0xffffffff [0257.183] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1eaf9c30, ftCreationTime.dwHighDateTime=0x1d824b7, ftLastAccessTime.dwLowDateTime=0xf744a440, ftLastAccessTime.dwHighDateTime=0x1d82882, ftLastWriteTime.dwLowDateTime=0xf744a440, ftLastWriteTime.dwHighDateTime=0x1d82882, nFileSizeHigh=0x0, nFileSizeLow=0xb5b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="gX6Wjm-hDVexWq.pps", cAlternateFileName="GX6WJM~1.PPS")) returned 1 [0257.184] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\gX6Wjm-hDVexWq.pps" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\gx6wjm-hdvexwq.pps"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.184] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\gX6Wjm-hDVexWq.pps.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\gx6wjm-hdvexwq.pps.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0257.185] GetFileSize (in: hFile=0xec, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xb5b9 [0257.185] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0257.185] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0257.231] ReadFile (in: hFile=0xec, lpBuffer=0x299000c, nNumberOfBytesToRead=0xb5b9, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0xb5b9, lpOverlapped=0x0) returned 1 [0257.233] WriteFile (in: hFile=0xf0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xb5c0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0xb5c0, lpOverlapped=0x0) returned 1 [0257.234] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.308] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.320] CloseHandle (hObject=0xec) returned 1 [0257.320] CloseHandle (hObject=0xf0) returned 1 [0257.320] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\gX6Wjm-hDVexWq.pps" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\gx6wjm-hdvexwq.pps"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\gX6Wjm-hDVexWq.pps.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\gx6wjm-hdvexwq.pps.ozq0")) returned 0 [0257.321] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\gX6Wjm-hDVexWq.pps.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\gx6wjm-hdvexwq.pps.ozq0")) returned 0x2020 [0257.321] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\gX6Wjm-hDVexWq.pps", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1eaf9c30, ftCreationTime.dwHighDateTime=0x1d824b7, ftLastAccessTime.dwLowDateTime=0xf744a440, ftLastAccessTime.dwHighDateTime=0x1d82882, ftLastWriteTime.dwLowDateTime=0xf744a440, ftLastWriteTime.dwHighDateTime=0x1d82882, nFileSizeHigh=0x0, nFileSizeLow=0xb5b9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="gX6Wjm-hDVexWq.pps", cAlternateFileName="GX6WJM~1.PPS")) returned 0x26dcb0 [0257.321] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1eaf9c30, ftCreationTime.dwHighDateTime=0x1d824b7, ftLastAccessTime.dwLowDateTime=0xf744a440, ftLastAccessTime.dwHighDateTime=0x1d82882, ftLastWriteTime.dwLowDateTime=0xf744a440, ftLastWriteTime.dwHighDateTime=0x1d82882, nFileSizeHigh=0x0, nFileSizeLow=0xb5b9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="gX6Wjm-hDVexWq.pps", cAlternateFileName="GX6WJM~1.PPS")) returned 0 [0257.321] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0257.321] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\gX6Wjm-hDVexWq.pps" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\gx6wjm-hdvexwq.pps")) returned 1 [0257.323] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\gX6Wjm-hDVexWq.pps" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\gx6wjm-hdvexwq.pps")) returned 0xffffffff [0257.323] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7964c250, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0257.323] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Identities\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7964c250, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c006a, dwReserved1=0x274df8, cFileName=".", cAlternateFileName="")) returned 0x26dcb0 [0257.323] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7964c250, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c006a, dwReserved1=0x274df8, cFileName="..", cAlternateFileName="")) returned 1 [0257.324] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7964c250, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c006a, dwReserved1=0x274df8, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0257.324] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7964c250, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250078, dwReserved1=0x26ddc0, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0257.324] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7964c250, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250078, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 1 [0257.324] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7964c250, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250078, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 0 [0257.324] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0257.324] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7964c250, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7964c250, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6c006a, dwReserved1=0x274df8, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0257.324] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0257.324] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9ece370, ftCreationTime.dwHighDateTime=0x1d823ab, ftLastAccessTime.dwLowDateTime=0xb8096560, ftLastAccessTime.dwHighDateTime=0x1d8279a, ftLastWriteTime.dwLowDateTime=0xb8096560, ftLastWriteTime.dwHighDateTime=0x1d8279a, nFileSizeHigh=0x0, nFileSizeLow=0x42af, dwReserved0=0x2d333244, dwReserved1=0x45434334, cFileName="l u8b.bmp", cAlternateFileName="LU8B~1.BMP")) returned 1 [0257.324] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\l u8b.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\l u8b.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf0 [0257.325] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\l u8b.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\l u8b.bmp.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xec [0257.325] GetFileSize (in: hFile=0xf0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42af [0257.325] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0257.326] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0257.370] ReadFile (in: hFile=0xf0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x42af, lpNumberOfBytesRead=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18f2a0*=0x42af, lpOverlapped=0x0) returned 1 [0257.371] WriteFile (in: hFile=0xec, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x18f2a0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18f2a0*=0x42b0, lpOverlapped=0x0) returned 1 [0257.372] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.431] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.443] CloseHandle (hObject=0xf0) returned 1 [0257.443] CloseHandle (hObject=0xec) returned 1 [0257.443] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\l u8b.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\l u8b.bmp"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\l u8b.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\l u8b.bmp.ozq0")) returned 0 [0257.444] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\l u8b.bmp.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\l u8b.bmp.ozq0")) returned 0x2020 [0257.444] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\l u8b.bmp", lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9ece370, ftCreationTime.dwHighDateTime=0x1d823ab, ftLastAccessTime.dwLowDateTime=0xb8096560, ftLastAccessTime.dwHighDateTime=0x1d8279a, ftLastWriteTime.dwLowDateTime=0xb8096560, ftLastWriteTime.dwHighDateTime=0x1d8279a, nFileSizeHigh=0x0, nFileSizeLow=0x42af, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="l u8b.bmp", cAlternateFileName="LU8B~1.BMP")) returned 0x26dcb0 [0257.444] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f19c | out: lpFindFileData=0x18f19c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9ece370, ftCreationTime.dwHighDateTime=0x1d823ab, ftLastAccessTime.dwLowDateTime=0xb8096560, ftLastAccessTime.dwHighDateTime=0x1d8279a, ftLastWriteTime.dwLowDateTime=0xb8096560, ftLastWriteTime.dwHighDateTime=0x1d8279a, nFileSizeHigh=0x0, nFileSizeLow=0x42af, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="l u8b.bmp", cAlternateFileName="LU8B~1.BMP")) returned 0 [0257.444] FindClose (in: hFindFile=0x26dcb0 | out: hFindFile=0x26dcb0) returned 1 [0257.444] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\l u8b.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\l u8b.bmp")) returned 1 [0257.446] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\l u8b.bmp" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\l u8b.bmp")) returned 0xffffffff [0257.446] FindNextFileA (in: hFindFile=0x26dd08, lpFindFileData=0x18f528 | out: lpFindFileData=0x18f528*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426ba7c0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x7665230d, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0257.446] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\*.*", lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426ba7c0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName=".", cAlternateFileName="")) returned 0x26dcb0 [0257.446] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426ba7c0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName="..", cAlternateFileName="")) returned 1 [0257.446] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b3af0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3b3af0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3b3af0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName="AddIns", cAlternateFileName="")) returned 1 [0257.446] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\AddIns\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b3af0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3b3af0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3b3af0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0257.447] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b3af0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3b3af0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3b3af0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 1 [0257.447] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3b3af0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3b3af0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3b3af0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 0 [0257.447] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0257.447] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x285f4ad0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0257.447] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x285f4ad0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0257.450] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x285f4ad0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="..", cAlternateFileName="")) returned 1 [0257.450] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2861ac30, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="Style", cAlternateFileName="")) returned 1 [0257.450] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2861ac30, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0257.451] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2861ac30, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0257.451] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6f297690, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x51722, dwReserved0=0x18eb6c, dwReserved1=0x76f73c74, cFileName="APASixthEditionOfficeOnline.xsl", cAlternateFileName="APASIX~1.XSL")) returned 1 [0257.452] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.453] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0257.454] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x51722 [0257.454] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0257.454] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0257.499] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x51722, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x51722, lpOverlapped=0x0) returned 1 [0257.510] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x51730, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x51730, lpOverlapped=0x0) returned 1 [0257.516] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.575] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.586] CloseHandle (hObject=0xe0) returned 1 [0257.586] CloseHandle (hObject=0xe8) returned 1 [0257.586] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl.ozq0")) returned 0 [0257.587] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl.ozq0")) returned 0x2020 [0257.587] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6f297690, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x51722, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="APASixthEditionOfficeOnline.xsl", cAlternateFileName="APASIX~1.XSL")) returned 0x277eb8 [0257.587] FindNextFileA (in: hFindFile=0x277eb8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6f297690, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x51722, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="APASixthEditionOfficeOnline.xsl", cAlternateFileName="APASIX~1.XSL")) returned 0 [0257.587] FindClose (in: hFindFile=0x277eb8 | out: hFindFile=0x277eb8) returned 1 [0257.588] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl")) returned 1 [0257.591] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\APASixthEditionOfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\apasixtheditionofficeonline.xsl")) returned 0xffffffff [0257.591] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x48839, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 1 [0257.592] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0257.592] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.592] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x48839 [0257.592] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0257.593] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0257.638] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x48839, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x48839, lpOverlapped=0x0) returned 1 [0257.666] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x48840, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x48840, lpOverlapped=0x0) returned 1 [0257.671] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.727] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.739] CloseHandle (hObject=0xe8) returned 1 [0257.739] CloseHandle (hObject=0xe0) returned 1 [0257.739] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl.ozq0")) returned 0 [0257.740] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl.ozq0")) returned 0x2020 [0257.740] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x48839, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 0x277df0 [0257.740] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x48839, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CHICAGO.XSL", cAlternateFileName="")) returned 0 [0257.740] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0257.740] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl")) returned 1 [0257.744] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\chicago.xsl")) returned 0xffffffff [0257.744] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB.XSL", cAlternateFileName="")) returned 1 [0257.744] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.744] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0257.745] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4197e [0257.745] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0257.745] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0257.786] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4197e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4197e, lpOverlapped=0x0) returned 1 [0257.812] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x41980, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x41980, lpOverlapped=0x0) returned 1 [0257.817] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0257.898] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0257.909] CloseHandle (hObject=0xe0) returned 1 [0257.910] CloseHandle (hObject=0xe8) returned 1 [0257.910] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl.ozq0")) returned 0 [0257.911] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl.ozq0")) returned 0x2020 [0257.911] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4197e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="GB.XSL", cAlternateFileName="")) returned 0x277e88 [0257.911] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x4197e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="GB.XSL", cAlternateFileName="")) returned 0 [0257.911] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0257.911] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl")) returned 1 [0257.914] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gb.xsl")) returned 0xffffffff [0257.914] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef05590, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3e966, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="GostName.XSL", cAlternateFileName="")) returned 1 [0257.914] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0257.915] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0257.915] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e966 [0257.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0257.916] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0257.964] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3e966, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3e966, lpOverlapped=0x0) returned 1 [0257.969] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3e970, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3e970, lpOverlapped=0x0) returned 1 [0257.973] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.035] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.046] CloseHandle (hObject=0xe8) returned 1 [0258.046] CloseHandle (hObject=0xe0) returned 1 [0258.046] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl.ozq0")) returned 0 [0258.047] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl.ozq0")) returned 0x2020 [0258.047] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef05590, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3e966, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="GostName.XSL", cAlternateFileName="")) returned 0x277e98 [0258.047] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef05590, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3e966, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="GostName.XSL", cAlternateFileName="")) returned 0 [0258.047] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0258.047] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl")) returned 1 [0258.050] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gostname.xsl")) returned 0xffffffff [0258.050] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef05590, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3d639, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 1 [0258.051] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0258.051] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0258.052] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d639 [0258.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0258.052] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0258.110] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3d639, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3d639, lpOverlapped=0x0) returned 1 [0258.115] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3d640, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3d640, lpOverlapped=0x0) returned 1 [0258.119] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.185] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.196] CloseHandle (hObject=0xe0) returned 1 [0258.196] CloseHandle (hObject=0xe8) returned 1 [0258.197] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl.ozq0")) returned 0 [0258.197] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl.ozq0")) returned 0x2020 [0258.197] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef05590, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3d639, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 0x277e98 [0258.198] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x285f4ad0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef05590, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3d639, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="GostTitle.XSL", cAlternateFileName="GOSTTI~1.XSL")) returned 0 [0258.198] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0258.198] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl")) returned 1 [0258.200] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\gosttitle.xsl")) returned 0xffffffff [0258.200] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x45882, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="HarvardAnglia2008OfficeOnline.xsl", cAlternateFileName="HARVAR~1.XSL")) returned 1 [0258.201] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0258.201] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0258.202] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x45882 [0258.202] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0258.202] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0258.248] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x45882, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x45882, lpOverlapped=0x0) returned 1 [0258.259] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x45890, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x45890, lpOverlapped=0x0) returned 1 [0258.264] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.327] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.339] CloseHandle (hObject=0xe8) returned 1 [0258.339] CloseHandle (hObject=0xe0) returned 1 [0258.339] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl.ozq0")) returned 0 [0258.340] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl.ozq0")) returned 0x2020 [0258.340] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x45882, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="HarvardAnglia2008OfficeOnline.xsl", cAlternateFileName="HARVAR~1.XSL")) returned 0x277ec0 [0258.340] FindNextFileA (in: hFindFile=0x277ec0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ef779b0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x45882, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="HarvardAnglia2008OfficeOnline.xsl", cAlternateFileName="HARVAR~1.XSL")) returned 0 [0258.340] FindClose (in: hFindFile=0x277ec0 | out: hFindFile=0x277ec0) returned 1 [0258.340] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl")) returned 1 [0258.343] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\HarvardAnglia2008OfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\harvardanglia2008officeonline.xsl")) returned 0xffffffff [0258.343] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fac6230, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x47e7d, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="IEEE2006OfficeOnline.xsl", cAlternateFileName="IEEE20~1.XSL")) returned 1 [0258.344] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0258.344] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0258.345] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x47e7d [0258.345] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0258.345] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0258.402] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x47e7d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x47e7d, lpOverlapped=0x0) returned 1 [0258.418] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x47e80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x47e80, lpOverlapped=0x0) returned 1 [0258.423] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0258.476] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0258.487] CloseHandle (hObject=0xe0) returned 1 [0258.487] CloseHandle (hObject=0xe8) returned 1 [0258.487] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl.ozq0")) returned 0 [0258.488] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl.ozq0")) returned 0x2020 [0258.488] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fac6230, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x47e7d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="IEEE2006OfficeOnline.xsl", cAlternateFileName="IEEE20~1.XSL")) returned 0x277eb0 [0258.488] FindNextFileA (in: hFindFile=0x277eb0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fac6230, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x47e7d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="IEEE2006OfficeOnline.xsl", cAlternateFileName="IEEE20~1.XSL")) returned 0 [0258.488] FindClose (in: hFindFile=0x277eb0 | out: hFindFile=0x277eb0) returned 1 [0258.489] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl")) returned 1 [0258.492] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\IEEE2006OfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\ieee2006officeonline.xsl")) returned 0xffffffff [0258.492] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fa2dcb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x42132, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ISO690.XSL", cAlternateFileName="")) returned 1 [0258.492] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0258.492] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0258.493] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x42132 [0258.493] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0258.493] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0258.533] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x42132, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x42132, lpOverlapped=0x0) returned 1 [0259.205] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x42140, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x42140, lpOverlapped=0x0) returned 1 [0259.210] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.272] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.285] CloseHandle (hObject=0xe8) returned 1 [0259.285] CloseHandle (hObject=0xe0) returned 1 [0259.286] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl.ozq0")) returned 0 [0259.286] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl.ozq0")) returned 0x2020 [0259.287] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fa2dcb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x42132, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ISO690.XSL", cAlternateFileName="")) returned 0x277df0 [0259.287] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fa2dcb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x42132, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ISO690.XSL", cAlternateFileName="")) returned 0 [0259.287] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0259.287] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl")) returned 1 [0259.290] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690.xsl")) returned 0xffffffff [0259.290] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fa2dcb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x351ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 1 [0259.291] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0259.379] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0259.380] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x351ea [0259.380] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0259.380] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0259.427] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x351ea, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x351ea, lpOverlapped=0x0) returned 1 [0259.530] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x351f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x351f0, lpOverlapped=0x0) returned 1 [0259.535] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.588] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.601] CloseHandle (hObject=0xe0) returned 1 [0259.601] CloseHandle (hObject=0xe8) returned 1 [0259.601] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl.ozq0")) returned 0 [0259.602] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl.ozq0")) returned 0x2020 [0259.602] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fa2dcb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x351ea, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 0x277ea0 [0259.602] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6fa2dcb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x351ea, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ISO690Nmerical.XSL", cAlternateFileName="ISO690~1.XSL")) returned 0 [0259.602] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0259.602] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl")) returned 1 [0259.604] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\iso690nmerical.xsl")) returned 0xffffffff [0259.604] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6f629790, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3e4f3, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="MLASeventhEditionOfficeOnline.xsl", cAlternateFileName="MLASEV~1.XSL")) returned 1 [0259.605] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0259.605] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0259.608] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e4f3 [0259.608] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0259.609] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0259.650] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3e4f3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3e4f3, lpOverlapped=0x0) returned 1 [0259.654] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3e500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3e500, lpOverlapped=0x0) returned 1 [0259.659] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.725] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.737] CloseHandle (hObject=0xe8) returned 1 [0259.737] CloseHandle (hObject=0xe0) returned 1 [0259.738] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl.ozq0")) returned 0 [0259.738] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl.ozq0")) returned 0x2020 [0259.738] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6f629790, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3e4f3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MLASeventhEditionOfficeOnline.xsl", cAlternateFileName="MLASEV~1.XSL")) returned 0x277ec0 [0259.739] FindNextFileA (in: hFindFile=0x277ec0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6f629790, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3e4f3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MLASeventhEditionOfficeOnline.xsl", cAlternateFileName="MLASEV~1.XSL")) returned 0 [0259.739] FindClose (in: hFindFile=0x277ec0 | out: hFindFile=0x277ec0) returned 1 [0259.739] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl")) returned 1 [0259.741] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\MLASeventhEditionOfficeOnline.xsl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\mlaseventheditionofficeonline.xsl")) returned 0xffffffff [0259.741] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ff88e30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="SIST02.XSL", cAlternateFileName="")) returned 1 [0259.741] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0259.742] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0259.742] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d5c8 [0259.742] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0259.743] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0259.787] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3d5c8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3d5c8, lpOverlapped=0x0) returned 1 [0259.814] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3d5d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3d5d0, lpOverlapped=0x0) returned 1 [0259.822] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0259.885] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0259.900] CloseHandle (hObject=0xe0) returned 1 [0259.900] CloseHandle (hObject=0xe8) returned 1 [0259.900] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl.ozq0")) returned 0 [0259.901] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl.ozq0")) returned 0x2020 [0259.901] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ff88e30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SIST02.XSL", cAlternateFileName="")) returned 0x277df0 [0259.901] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x6ff88e30, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SIST02.XSL", cAlternateFileName="")) returned 0 [0259.902] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0259.902] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl")) returned 1 [0259.905] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\sist02.xsl")) returned 0xffffffff [0259.905] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x70497cf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x54256, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 1 [0259.905] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0259.906] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0259.906] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x54256 [0259.907] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0259.907] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0259.976] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x54256, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x54256, lpOverlapped=0x0) returned 1 [0260.598] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x54260, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x54260, lpOverlapped=0x0) returned 1 [0260.605] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0260.668] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0260.681] CloseHandle (hObject=0xe8) returned 1 [0260.681] CloseHandle (hObject=0xe0) returned 1 [0260.681] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl.ozq0")) returned 0 [0260.682] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl.ozq0")) returned 0x2020 [0260.682] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x70497cf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x54256, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 0x277e98 [0260.682] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x70497cf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x54256, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 0 [0260.682] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0260.682] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl")) returned 1 [0260.686] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\bibliography\\style\\turabian.xsl")) returned 0xffffffff [0260.686] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2861ac30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x70497cf0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x54256, dwReserved0=0x0, dwReserved1=0x0, cFileName="TURABIAN.XSL", cAlternateFileName="")) returned 0 [0260.686] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0260.687] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x285f4ad0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2861ac30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2861ac30, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x26ddc0, cFileName="Style", cAlternateFileName="")) returned 0 [0260.687] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0260.687] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1 [0260.687] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0260.687] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="..", cAlternateFileName="")) returned 1 [0260.687] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="..", cAlternateFileName="")) returned 0 [0260.687] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0260.687] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName="Crypto", cAlternateFileName="")) returned 1 [0260.687] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Crypto\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0260.688] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="..", cAlternateFileName="")) returned 1 [0260.688] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="RSA", cAlternateFileName="")) returned 1 [0260.688] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0260.689] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0260.689] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0260.689] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0260.689] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x5af83960, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="RSA", cAlternateFileName="")) returned 0 [0260.689] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0260.689] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName="Document Building Blocks", cAlternateFileName="DOCUME~1")) returned 1 [0260.689] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0260.756] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="..", cAlternateFileName="")) returned 1 [0260.757] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="1033", cAlternateFileName="")) returned 1 [0260.757] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0260.758] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0260.758] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="16", cAlternateFileName="")) returned 1 [0260.758] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x277ea0 [0260.758] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0260.758] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x72af9fb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x388cc7, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 1 [0260.765] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0260.765] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0260.766] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x388cc7 [0260.766] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0260.767] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0260.816] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x388cc7, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x388cc7, lpOverlapped=0x0) returned 1 [0261.024] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x388cd0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x388cd0, lpOverlapped=0x0) returned 1 [0261.094] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.165] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.177] CloseHandle (hObject=0xe8) returned 1 [0261.177] CloseHandle (hObject=0xdc) returned 1 [0261.177] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx.ozq0")) returned 0 [0261.178] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx.ozq0")) returned 0x2020 [0261.178] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x72af9fb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x388cc7, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0x277df0 [0261.178] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x72af9fb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x388cc7, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0261.178] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0261.178] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx")) returned 1 [0261.191] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\16\\Built-In Building Blocks.dotx" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\document building blocks\\1033\\16\\built-in building blocks.dotx")) returned 0xffffffff [0261.191] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x72af9fb0, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x388cc7, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="Built-In Building Blocks.dotx", cAlternateFileName="BUILT-~1.DOT")) returned 0 [0261.191] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0261.191] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="16", cAlternateFileName="")) returned 0 [0261.192] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0261.192] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28986bd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x28986bd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x28986bd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="1033", cAlternateFileName="")) returned 0 [0261.192] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0261.192] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d9c50, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3d9c50, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3d9c50, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName="Excel", cAlternateFileName="")) returned 1 [0261.192] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Excel\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d9c50, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3d9c50, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3d9c50, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0261.192] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d9c50, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3d9c50, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3d9c50, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="..", cAlternateFileName="")) returned 1 [0261.193] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d9c50, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3d9c50, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3d9c50, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0261.193] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d9c50, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3d9c50, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3d9c50, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0261.193] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d9c50, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3d9c50, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3d9c50, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 1 [0261.193] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d9c50, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3d9c50, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3d9c50, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 0 [0261.193] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0261.193] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d9c50, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3d9c50, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3d9c50, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="XLSTART", cAlternateFileName="")) returned 0 [0261.193] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0261.193] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795fff90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0058, dwReserved1=0x26dd48, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0261.193] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795fff90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0261.193] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795fff90, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfda27f60, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="..", cAlternateFileName="")) returned 1 [0261.193] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x4d24b360, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 1 [0261.194] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x4d24b360, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0261.194] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x4d24b360, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="..", cAlternateFileName="")) returned 1 [0261.194] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x69646c69, dwReserved1=0x4220676e, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0261.194] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0261.194] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0261.196] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd [0261.196] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0261.196] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0261.261] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xdd, lpOverlapped=0x0) returned 1 [0261.262] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe0, lpOverlapped=0x0) returned 1 [0261.263] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.327] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.342] CloseHandle (hObject=0xe0) returned 1 [0261.342] CloseHandle (hObject=0xdc) returned 1 [0261.343] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.ozq0")) returned 0 [0261.343] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini.ozq0")) returned 0x20 [0261.343] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277ea8 [0261.344] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0261.344] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0261.344] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 1 [0261.345] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\desktop.ini")) returned 0xffffffff [0261.345] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d24b360, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x4d24b360, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 1 [0261.345] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0261.346] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0261.348] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a7 [0261.348] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0261.348] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0261.395] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5a7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x5a7, lpOverlapped=0x0) returned 1 [0261.707] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x5b0, lpOverlapped=0x0) returned 1 [0261.708] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0261.768] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0261.780] CloseHandle (hObject=0xdc) returned 1 [0261.780] CloseHandle (hObject=0xe0) returned 1 [0261.780] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.ozq0")) returned 0 [0261.781] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.ozq0")) returned 0x20 [0261.781] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d24b360, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x4d24b360, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 0x277ee0 [0261.781] FindNextFileA (in: hFindFile=0x277ee0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d24b360, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x4d24b360, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Launch Internet Explorer Browser.lnk", cAlternateFileName="LAUNCH~1.LNK")) returned 0 [0261.782] FindClose (in: hFindFile=0x277ee0 | out: hFindFile=0x277ee0) returned 1 [0261.782] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 1 [0261.783] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 0xffffffff [0261.783] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5021c250, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5021c250, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x502423b0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Microsoft Outlook.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0261.783] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0261.784] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0261.785] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4ce [0261.785] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0261.785] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0261.841] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4ce, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4ce, lpOverlapped=0x0) returned 1 [0262.190] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x4d0, lpOverlapped=0x0) returned 1 [0262.191] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.637] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.649] CloseHandle (hObject=0xe0) returned 1 [0262.649] CloseHandle (hObject=0xdc) returned 1 [0262.649] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.ozq0")) returned 0 [0262.650] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk.ozq0")) returned 0x20 [0262.650] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5021c250, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5021c250, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x502423b0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Microsoft Outlook.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0x277ec0 [0262.651] FindNextFileA (in: hFindFile=0x277ec0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5021c250, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5021c250, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x502423b0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Microsoft Outlook.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0262.651] FindClose (in: hFindFile=0x277ec0 | out: hFindFile=0x277ec0) returned 1 [0262.651] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk")) returned 1 [0262.652] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Microsoft Outlook.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\microsoft outlook.lnk")) returned 0xffffffff [0262.652] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 1 [0262.652] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0262.653] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0262.654] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x122 [0262.654] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0262.654] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0262.714] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x122, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x122, lpOverlapped=0x0) returned 1 [0262.715] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x130, lpOverlapped=0x0) returned 1 [0262.716] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.776] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.788] CloseHandle (hObject=0xdc) returned 1 [0262.788] CloseHandle (hObject=0xe0) returned 1 [0262.788] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.ozq0")) returned 0 [0262.789] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.ozq0")) returned 0x20 [0262.789] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0x277eb8 [0262.789] FindNextFileA (in: hFindFile=0x277eb8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e11d030, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Shows Desktop.lnk", cAlternateFileName="SHOWSD~1.LNK")) returned 0 [0262.789] FindClose (in: hFindFile=0x277eb8 | out: hFindFile=0x277eb8) returned 1 [0262.789] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0262.790] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 0xffffffff [0262.790] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="User Pinned", cAlternateFileName="USERPI~1")) returned 1 [0262.790] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x277df0, cFileName=".", cAlternateFileName="")) returned 0x277eb0 [0262.790] FindNextFileA (in: hFindFile=0x277eb0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x119ccee, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 1 [0262.790] FindNextFileA (in: hFindFile=0x277eb0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x277df0, cFileName="ImplicitAppShortcuts", cAlternateFileName="IMPLIC~1")) returned 1 [0262.790] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName=".", cAlternateFileName="")) returned 0x277df0 [0262.791] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName="..", cAlternateFileName="")) returned 1 [0262.791] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x796260f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x796260f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf98cef90, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName="..", cAlternateFileName="")) returned 0 [0262.791] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0262.791] FindNextFileA (in: hFindFile=0x277eb0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xe8925870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8925870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x277df0, cFileName="TaskBar", cAlternateFileName="")) returned 1 [0262.792] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xe8925870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8925870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName=".", cAlternateFileName="")) returned 0x277df0 [0262.792] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xe8925870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8925870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName="..", cAlternateFileName="")) returned 1 [0262.792] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f125f50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x250000, dwReserved1=0x279fe0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0262.792] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0262.793] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0262.796] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19c [0262.796] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0262.797] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0262.852] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x19c, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x19c, lpOverlapped=0x0) returned 1 [0262.854] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x1a0, lpOverlapped=0x0) returned 1 [0262.855] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0262.919] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0262.932] CloseHandle (hObject=0xe8) returned 1 [0262.932] CloseHandle (hObject=0xf4) returned 1 [0262.933] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.ozq0")) returned 0 [0262.934] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini.ozq0")) returned 0x20 [0262.934] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f125f50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e30 [0262.934] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f125f50, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0262.934] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0262.934] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 1 [0262.936] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\desktop.ini")) returned 0xffffffff [0262.936] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8462c70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8462c70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 1 [0262.937] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0262.937] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0262.939] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x950 [0262.939] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0262.940] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0262.988] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x950, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x950, lpOverlapped=0x0) returned 1 [0262.989] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x960, lpOverlapped=0x0) returned 1 [0262.991] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.055] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.068] CloseHandle (hObject=0xf4) returned 1 [0263.068] CloseHandle (hObject=0xe8) returned 1 [0263.068] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk.ozq0")) returned 0 [0263.069] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk.ozq0")) returned 0x20 [0263.069] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8462c70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8462c70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 0x277e30 [0263.069] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8462c70, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8462c70, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad191d70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x950, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Excel 2016.lnk", cAlternateFileName="EXCEL2~1.LNK")) returned 0 [0263.069] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0263.070] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk")) returned 1 [0263.073] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Excel 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\excel 2016.lnk")) returned 0xffffffff [0263.073] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0f5210, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f0f5210, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ed7ee60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 1 [0263.073] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0263.073] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0263.075] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5ad [0263.075] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0263.075] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0263.121] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5ad, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x5ad, lpOverlapped=0x0) returned 1 [0263.122] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x5b0, lpOverlapped=0x0) returned 1 [0263.123] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.190] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.202] CloseHandle (hObject=0xe8) returned 1 [0263.202] CloseHandle (hObject=0xf4) returned 1 [0263.203] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.ozq0")) returned 0 [0263.204] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.ozq0")) returned 0x20 [0263.204] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0f5210, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f0f5210, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ed7ee60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0x277e30 [0263.204] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f0f5210, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f0f5210, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ed7ee60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Internet Explorer (2).lnk", cAlternateFileName="INTERN~2.LNK")) returned 0 [0263.204] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0263.204] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 1 [0263.206] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 0xffffffff [0263.206] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 1 [0263.207] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0263.208] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0263.209] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x5a9 [0263.209] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0263.209] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0263.287] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x5a9, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x5a9, lpOverlapped=0x0) returned 1 [0263.289] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x5b0, lpOverlapped=0x0) returned 1 [0263.290] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.347] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.358] CloseHandle (hObject=0xf4) returned 1 [0263.359] CloseHandle (hObject=0xe8) returned 1 [0263.361] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.ozq0")) returned 0 [0263.362] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.ozq0")) returned 0x20 [0263.362] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0x277e30 [0263.362] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x921e7f, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x5a9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Internet Explorer.lnk", cAlternateFileName="INTERN~1.LNK")) returned 0 [0263.363] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0263.363] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 1 [0263.364] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 0xffffffff [0263.364] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8651e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8651e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad8b5f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 1 [0263.364] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0263.365] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0263.366] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x93c [0263.366] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0263.367] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0263.413] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x93c, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x93c, lpOverlapped=0x0) returned 1 [0263.413] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x940, lpOverlapped=0x0) returned 1 [0263.415] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.475] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.488] CloseHandle (hObject=0xe8) returned 1 [0263.488] CloseHandle (hObject=0xf4) returned 1 [0263.489] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk.ozq0")) returned 0 [0263.490] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk.ozq0")) returned 0x20 [0263.490] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8651e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8651e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad8b5f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 0x277e30 [0263.490] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8651e50, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8651e50, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad8b5f70, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x93c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="OneNote 2016.lnk", cAlternateFileName="ONENOT~1.LNK")) returned 0 [0263.490] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0263.490] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk")) returned 1 [0263.492] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\OneNote 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\onenote 2016.lnk")) returned 0xffffffff [0263.492] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe875c7f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe875c7f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 1 [0263.493] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0263.493] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0263.495] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x94a [0263.495] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0263.495] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0263.555] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x94a, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x94a, lpOverlapped=0x0) returned 1 [0263.555] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x950, lpOverlapped=0x0) returned 1 [0263.557] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.637] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.657] CloseHandle (hObject=0xf4) returned 1 [0263.657] CloseHandle (hObject=0xe8) returned 1 [0263.658] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk.ozq0")) returned 0 [0263.659] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk.ozq0")) returned 0x20 [0263.659] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe875c7f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe875c7f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 0x277e30 [0263.659] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe875c7f0, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe875c7f0, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Outlook 2016.lnk", cAlternateFileName="OUTLOO~1.LNK")) returned 0 [0263.659] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0263.659] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk")) returned 1 [0263.661] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Outlook 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\outlook 2016.lnk")) returned 0xffffffff [0263.661] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8867190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8867190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x975, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 1 [0263.661] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0263.661] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0263.663] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x975 [0263.663] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0263.663] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0263.708] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x975, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x975, lpOverlapped=0x0) returned 1 [0263.709] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x980, lpOverlapped=0x0) returned 1 [0263.710] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.765] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.776] CloseHandle (hObject=0xe8) returned 1 [0263.776] CloseHandle (hObject=0xf4) returned 1 [0263.777] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk.ozq0")) returned 0 [0263.778] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk.ozq0")) returned 0x20 [0263.778] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8867190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8867190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x975, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 0x277e30 [0263.778] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8867190, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8867190, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad928390, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x975, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="PowerPoint 2016.lnk", cAlternateFileName="POWERP~1.LNK")) returned 0 [0263.778] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0263.778] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk")) returned 1 [0263.780] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\PowerPoint 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\powerpoint 2016.lnk")) returned 0xffffffff [0263.780] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f10d8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f10d8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0263.780] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0263.781] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0263.783] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0263.783] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0263.783] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0263.828] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4cc, lpOverlapped=0x0) returned 1 [0263.829] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x4d0, lpOverlapped=0x0) returned 1 [0263.830] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0263.893] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0263.923] CloseHandle (hObject=0xf4) returned 1 [0263.923] CloseHandle (hObject=0xe8) returned 1 [0263.924] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.ozq0")) returned 0 [0263.925] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.ozq0")) returned 0x20 [0263.925] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f10d8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f10d8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0x277e30 [0263.925] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f10d8b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f10d8b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Windows Explorer (2).lnk", cAlternateFileName="WINDOW~3.LNK")) returned 0 [0263.925] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0263.925] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 1 [0263.927] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 0xffffffff [0263.927] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0263.927] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0263.928] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0263.930] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4cc [0263.930] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0263.930] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0263.978] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4cc, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x4cc, lpOverlapped=0x0) returned 1 [0263.979] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x4d0, lpOverlapped=0x0) returned 1 [0263.980] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.037] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.048] CloseHandle (hObject=0xe8) returned 1 [0264.048] CloseHandle (hObject=0xf4) returned 1 [0264.049] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.ozq0")) returned 0 [0264.049] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.ozq0")) returned 0x20 [0264.049] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0x277e30 [0264.050] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7dfa026d, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Windows Explorer.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0264.050] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0264.050] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 1 [0264.051] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 0xffffffff [0264.051] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f125f50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f125f50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0264.051] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0264.051] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0264.052] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60b [0264.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0264.053] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0264.099] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x60b, lpOverlapped=0x0) returned 1 [0264.099] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x610, lpOverlapped=0x0) returned 1 [0264.100] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.155] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.167] CloseHandle (hObject=0xf4) returned 1 [0264.167] CloseHandle (hObject=0xe8) returned 1 [0264.168] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.ozq0")) returned 0 [0264.168] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.ozq0")) returned 0x20 [0264.169] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f125f50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f125f50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0x277e30 [0264.169] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f125f50, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f125f50, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Windows Media Player (2).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 0 [0264.169] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0264.169] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 1 [0264.170] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 0xffffffff [0264.170] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0264.171] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0264.171] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0264.172] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x60b [0264.172] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0264.173] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0264.221] ReadFile (in: hFile=0xe8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x60b, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x60b, lpOverlapped=0x0) returned 1 [0264.223] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x610, lpOverlapped=0x0) returned 1 [0264.225] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.287] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.299] CloseHandle (hObject=0xe8) returned 1 [0264.299] CloseHandle (hObject=0xf4) returned 1 [0264.299] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.ozq0")) returned 0 [0264.300] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.ozq0")) returned 0x20 [0264.300] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x277e30 [0264.300] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x2e24b3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0264.300] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0264.300] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 1 [0264.301] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 0xffffffff [0264.301] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8925870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8925870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 1 [0264.302] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0264.302] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0264.303] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x976 [0264.303] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0264.303] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0264.493] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x976, lpNumberOfBytesRead=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e698*=0x976, lpOverlapped=0x0) returned 1 [0264.494] WriteFile (in: hFile=0xe8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18e698, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e698*=0x980, lpOverlapped=0x0) returned 1 [0264.495] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.558] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.582] CloseHandle (hObject=0xf4) returned 1 [0264.582] CloseHandle (hObject=0xe8) returned 1 [0264.583] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk.ozq0")) returned 0 [0264.584] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk.ozq0")) returned 0x20 [0264.584] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8925870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8925870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0x277e30 [0264.584] FindNextFileA (in: hFindFile=0x277e30, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8925870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8925870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0 [0264.585] FindClose (in: hFindFile=0x277e30 | out: hFindFile=0x277e30) returned 1 [0264.585] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk")) returned 1 [0264.587] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Word 2016.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\word 2016.lnk")) returned 0xffffffff [0264.587] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8925870, ftCreationTime.dwHighDateTime=0x1d70911, ftLastAccessTime.dwLowDateTime=0xe8925870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xad9c0910, ftLastWriteTime.dwHighDateTime=0x1d70910, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x76f7387a, dwReserved1=0x76653705, cFileName="Word 2016.lnk", cAlternateFileName="WORD20~1.LNK")) returned 0 [0264.587] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0264.587] FindNextFileA (in: hFindFile=0x277eb0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0xe8925870, ftLastAccessTime.dwHighDateTime=0x1d70911, ftLastWriteTime.dwLowDateTime=0xe8925870, ftLastWriteTime.dwHighDateTime=0x1d70911, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbc00ba, dwReserved1=0x277df0, cFileName="TaskBar", cAlternateFileName="")) returned 0 [0264.587] FindClose (in: hFindFile=0x277eb0 | out: hFindFile=0x277eb0) returned 1 [0264.587] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0264.588] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0264.589] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0264.590] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x110 [0264.590] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0264.590] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0264.658] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0264.659] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0264.661] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0264.715] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0264.728] CloseHandle (hObject=0xe0) returned 1 [0264.729] CloseHandle (hObject=0xdc) returned 1 [0264.729] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.ozq0")) returned 0 [0264.730] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.ozq0")) returned 0x20 [0264.730] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0x277eb8 [0264.730] FindNextFileA (in: hFindFile=0x277eb8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0264.730] FindClose (in: hFindFile=0x277eb8 | out: hFindFile=0x277eb8) returned 1 [0264.730] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0264.731] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 0xffffffff [0264.731] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e143190, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x726f6853, dwReserved1=0x74756374, cFileName="Window Switcher.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0264.731] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0264.731] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795fff90, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x4d24b360, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x4d24b360, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6974694c, dwReserved1=0x664f6e6f, cFileName="Quick Launch", cAlternateFileName="QUICKL~1")) returned 0 [0264.731] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0264.731] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0068, dwReserved1=0x26dd48, cFileName="Network", cAlternateFileName="")) returned 1 [0264.731] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0264.732] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0264.732] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0264.732] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0264.732] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0264.732] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Pbk", cAlternateFileName="")) returned 1 [0264.732] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x277df0 [0264.733] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0264.733] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 1 [0264.733] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*.*", lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x278ee8 [0264.733] FindNextFileA (in: hFindFile=0x278ee8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0264.733] FindNextFileA (in: hFindFile=0x278ee8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="rasphone.pbk", cAlternateFileName="")) returned 1 [0264.734] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe8 [0264.734] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0264.735] GetFileSize (in: hFile=0xe8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x0 [0264.735] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0264.735] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0264.844] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.ozq0")) returned 0 [0264.845] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk.ozq0")) returned 0x2020 [0264.845] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk", lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0x278e38 [0264.845] FindNextFileA (in: hFindFile=0x278e38, lpFindFileData=0x18e594 | out: lpFindFileData=0x18e594*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0264.845] FindClose (in: hFindFile=0x278e38 | out: hFindFile=0x278e38) returned 1 [0264.845] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk")) returned 1 [0264.845] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\rasphone.pbk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\rasphone.pbk")) returned 0xffffffff [0264.845] FindNextFileA (in: hFindFile=0x278ee8, lpFindFileData=0x18e920 | out: lpFindFileData=0x18e920*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e69c, dwReserved1=0x76f73c74, cFileName="rasphone.pbk", cAlternateFileName="")) returned 0 [0264.845] FindClose (in: hFindFile=0x278ee8 | out: hFindFile=0x278ee8) returned 1 [0264.845] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="_hiddenPbk", cAlternateFileName="_HIDDE~1")) returned 0 [0264.846] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0264.846] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Pbk", cAlternateFileName="")) returned 0 [0264.846] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0264.846] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82d9eea0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x82d9eea0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x82d9eea0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 0 [0264.846] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0264.846] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28666ef0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b32ecd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b32ecd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0068, dwReserved1=0x26dd48, cFileName="Office", cAlternateFileName="")) returned 1 [0264.846] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28666ef0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b32ecd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b32ecd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0265.068] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28666ef0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b32ecd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b32ecd0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="..", cAlternateFileName="")) returned 1 [0265.069] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2868d050, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2868d050, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2868d050, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x72656863, dwReserved1=0x6b6e6c2e, cFileName="MSO1033.acl", cAlternateFileName="")) returned 1 [0265.069] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0265.069] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\mso1033.acl.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0265.071] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9362 [0265.071] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0265.071] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0265.117] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9362, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x9362, lpOverlapped=0x0) returned 1 [0265.178] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9370, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x9370, lpOverlapped=0x0) returned 1 [0265.180] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.244] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.257] CloseHandle (hObject=0xf8) returned 1 [0265.257] CloseHandle (hObject=0xdc) returned 1 [0265.257] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\mso1033.acl"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\mso1033.acl.ozq0")) returned 0 [0265.258] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\mso1033.acl.ozq0")) returned 0x2020 [0265.258] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2868d050, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2868d050, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2868d050, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MSO1033.acl", cAlternateFileName="")) returned 0x26dd88 [0265.258] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2868d050, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2868d050, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2868d050, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x9362, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MSO1033.acl", cAlternateFileName="")) returned 0 [0265.258] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0265.259] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\mso1033.acl")) returned 1 [0265.260] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\MSO1033.acl" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\mso1033.acl")) returned 0xffffffff [0265.260] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b32ecd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b413510, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b413510, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Recent", cAlternateFileName="")) returned 1 [0265.260] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b32ecd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b413510, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b413510, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80007e, dwReserved1=0x276de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0265.260] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b32ecd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b413510, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b413510, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80007e, dwReserved1=0x276de8, cFileName="..", cAlternateFileName="")) returned 1 [0265.261] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x2b413510, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b413510, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b413510, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x80007e, dwReserved1=0x276de8, cFileName="index.dat", cAlternateFileName="")) returned 1 [0265.261] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0265.261] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0265.262] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1c [0265.262] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0265.262] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0265.322] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1c, lpOverlapped=0x0) returned 1 [0265.323] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x20, lpOverlapped=0x0) returned 1 [0265.324] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.383] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.397] CloseHandle (hObject=0xf8) returned 1 [0265.397] CloseHandle (hObject=0xe0) returned 1 [0265.397] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\index.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.ozq0")) returned 0 [0265.398] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\index.dat.ozq0")) returned 0x2020 [0265.398] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x2b413510, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b413510, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b413510, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0x277e88 [0265.398] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x2b413510, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b413510, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b413510, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x1c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0265.398] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0265.399] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 1 [0265.400] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\index.dat")) returned 0xffffffff [0265.400] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b3ed3b0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b3ed3b0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b3ed3b0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 1 [0265.400] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0265.401] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0265.402] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x451 [0265.402] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0265.402] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0265.449] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x451, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x451, lpOverlapped=0x0) returned 1 [0265.451] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x460, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x460, lpOverlapped=0x0) returned 1 [0265.452] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.510] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.522] CloseHandle (hObject=0xe0) returned 1 [0265.522] CloseHandle (hObject=0xf8) returned 1 [0265.522] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.ozq0")) returned 0 [0265.523] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk.ozq0")) returned 0x2020 [0265.523] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b3ed3b0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b3ed3b0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b3ed3b0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0x277df0 [0265.523] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b3ed3b0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b3ed3b0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b3ed3b0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0265.524] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0265.524] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk")) returned 1 [0265.525] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Templates.LNK" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\office\\recent\\templates.lnk")) returned 0xffffffff [0265.525] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b3ed3b0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b3ed3b0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b3ed3b0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Templates.LNK", cAlternateFileName="TEMPLA~1.LNK")) returned 0 [0265.525] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0265.525] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2b32ecd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b413510, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b413510, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Recent", cAlternateFileName="")) returned 0 [0265.525] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0265.525] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x500531d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5b267fb0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x5b267fb0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0068, dwReserved1=0x26dd48, cFileName="Outlook", cAlternateFileName="")) returned 1 [0265.525] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x500531d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5b267fb0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x5b267fb0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f74b4e, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0265.526] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x500531d0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5b267fb0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x5b267fb0, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f74b4e, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0265.526] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53aa4cd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x53aa4cd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3a502870, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x76f74b4e, dwReserved1=0x76653c7d, cFileName="Outlook.srs", cAlternateFileName="")) returned 1 [0265.526] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0265.526] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0265.527] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa00 [0265.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0265.527] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0265.575] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0xa00, lpOverlapped=0x0) returned 1 [0265.578] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0xa10, lpOverlapped=0x0) returned 1 [0265.579] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.644] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.656] CloseHandle (hObject=0xdc) returned 1 [0265.656] CloseHandle (hObject=0xf8) returned 1 [0265.657] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.srs"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.ozq0")) returned 0 [0265.658] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.srs.ozq0")) returned 0x2020 [0265.658] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53aa4cd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x53aa4cd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3a502870, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Outlook.srs", cAlternateFileName="")) returned 0x26dd88 [0265.658] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x53aa4cd0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x53aa4cd0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3a502870, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Outlook.srs", cAlternateFileName="")) returned 0 [0265.658] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0265.658] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.srs")) returned 1 [0265.659] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.srs" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.srs")) returned 0xffffffff [0265.659] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b267fb0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5b267fb0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3a907d30, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x93e, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Outlook.xml", cAlternateFileName="")) returned 1 [0265.659] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0265.660] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0265.660] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x93e [0265.660] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0265.661] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0265.707] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x93e, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x93e, lpOverlapped=0x0) returned 1 [0265.711] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x940, lpOverlapped=0x0) returned 1 [0265.712] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.773] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.785] CloseHandle (hObject=0xf8) returned 1 [0265.786] CloseHandle (hObject=0xdc) returned 1 [0265.786] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.ozq0")) returned 0 [0265.787] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.ozq0")) returned 0x2020 [0265.787] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b267fb0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5b267fb0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3a907d30, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x93e, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Outlook.xml", cAlternateFileName="")) returned 0x26dd88 [0265.787] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b267fb0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5b267fb0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3a907d30, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x93e, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0265.787] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0265.787] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 1 [0265.788] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 0xffffffff [0265.788] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b267fb0, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x5b267fb0, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x3a907d30, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x93e, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Outlook.xml", cAlternateFileName="")) returned 0 [0265.788] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0265.793] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42694660, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x42694660, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x42694660, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0068, dwReserved1=0x26dd48, cFileName="Proof", cAlternateFileName="")) returned 1 [0265.793] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Proof\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42694660, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x42694660, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x42694660, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0265.793] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42694660, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x42694660, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x42694660, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0265.793] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x42694660, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x42694660, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x42694660, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 0 [0265.793] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0265.793] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x30b088f0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x30b088f0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a0068, dwReserved1=0x26dd48, cFileName="Protect", cAlternateFileName="")) returned 1 [0265.793] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Protect\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x30b088f0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x30b088f0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0265.794] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x30b088f0, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x30b088f0, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0265.794] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x79a044b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79a044b0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x47b8e1c0, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="CREDHIST", cAlternateFileName="")) returned 1 [0265.794] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="S-1-5-21-3111613574-2524581245-2586426736-500", cAlternateFileName="S-1-5-~1")) returned 1 [0265.794] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x820080, dwReserved1=0x276de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0265.820] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x820080, dwReserved1=0x276de8, cFileName="..", cAlternateFileName="")) returned 1 [0265.820] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2b9bd87, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x820080, dwReserved1=0x276de8, cFileName="be5b4fbd-cb99-45f5-9462-5f896dd3a6b9", cAlternateFileName="BE5B4F~1")) returned 1 [0265.820] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0265.820] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0265.820] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0265.822] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30b088f0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x510a9850, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x510a9850, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3939, dwReserved1=0x2d356635, cFileName="S-1-5-21-4219442223-4223814209-3835049652-1000", cAlternateFileName="S-1-5-~2")) returned 1 [0265.822] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-4219442223-4223814209-3835049652-1000\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30b088f0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x510a9850, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x510a9850, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0265.822] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x30b088f0, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x510a9850, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x510a9850, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="..", cAlternateFileName="")) returned 1 [0265.822] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x510a7140, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x510a7140, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x510a9850, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x350034, dwReserved1=0x350066, cFileName="5641bb28-4900-44ac-8968-98cbaf4439cf", cAlternateFileName="5641BB~1")) returned 1 [0265.823] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x30ba0e70, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x30ba0e70, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x30ba0e70, ftLastWriteTime.dwHighDateTime=0x1d7100d, nFileSizeHigh=0x0, nFileSizeLow=0x1d4, dwReserved0=0x340034, dwReserved1=0x630061, cFileName="bbf2fe4c-d1f1-40ab-8fc1-1022146f6c9a", cAlternateFileName="BBF2FE~1")) returned 1 [0265.823] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x30bed130, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x30bed130, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x51101690, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x300034, dwReserved1=0x620061, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 1 [0265.823] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x30bed130, ftCreationTime.dwHighDateTime=0x1d7100d, ftLastAccessTime.dwLowDateTime=0x30bed130, ftLastAccessTime.dwHighDateTime=0x1d7100d, ftLastWriteTime.dwLowDateTime=0x51101690, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x300034, dwReserved1=0x620061, cFileName="Preferred", cAlternateFileName="PREFER~1")) returned 0 [0265.823] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0265.823] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7bba3b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7bba3b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x47bf4a60, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x342d3166, dwReserved1=0x2d626130, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0265.823] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7bba3b70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7bba3b70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x47bf4a60, ftLastWriteTime.dwHighDateTime=0x1d7a944, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x342d3166, dwReserved1=0x2d626130, cFileName="SYNCHIST", cAlternateFileName="")) returned 0 [0265.823] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0265.823] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34343931, dwReserved1=0x33323232, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0265.824] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3166, dwReserved1=0x2d626130, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0265.824] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3166, dwReserved1=0x2d626130, cFileName="..", cAlternateFileName="")) returned 1 [0265.824] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795d9e30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3166, dwReserved1=0x2d626130, cFileName="My", cAlternateFileName="")) returned 1 [0265.824] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795d9e30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300034, dwReserved1=0x620061, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0265.825] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795d9e30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300034, dwReserved1=0x620061, cFileName="..", cAlternateFileName="")) returned 1 [0265.825] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795d9e30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300034, dwReserved1=0x620061, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0265.825] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795d9e30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x277ea0 [0265.825] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795d9e30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0265.825] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795d9e30, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795d9e30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0265.825] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0265.825] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300034, dwReserved1=0x620061, cFileName="CRLs", cAlternateFileName="")) returned 1 [0265.826] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x277df0 [0265.826] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0265.826] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0265.826] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0265.826] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300034, dwReserved1=0x620061, cFileName="CTLs", cAlternateFileName="")) returned 1 [0265.826] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName=".", cAlternateFileName="")) returned 0x277df0 [0265.827] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 1 [0265.827] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18e904, dwReserved1=0x76f73c74, cFileName="..", cAlternateFileName="")) returned 0 [0265.827] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0265.827] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x300034, dwReserved1=0x620061, cFileName="CTLs", cAlternateFileName="")) returned 0 [0265.827] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0265.827] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795d9e30, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3166, dwReserved1=0x2d626130, cFileName="My", cAlternateFileName="")) returned 0 [0265.827] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0265.827] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x21509730, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3e1d8b20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x3e1d8b20, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34343931, dwReserved1=0x33323232, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0265.828] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x21509730, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3e1d8b20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x3e1d8b20, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3173, dwReserved1=0x2d626130, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0265.828] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x21509730, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x3e1d8b20, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x3e1d8b20, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x342d3173, dwReserved1=0x2d626130, cFileName="..", cAlternateFileName="")) returned 1 [0265.828] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b354e30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b354e30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b4aba90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x4615, dwReserved0=0x342d3173, dwReserved1=0x2d626130, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0265.829] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0265.829] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\templates\\normal.dotm.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0265.830] GetFileSize (in: hFile=0xdc, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4615 [0265.830] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0265.831] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0265.880] ReadFile (in: hFile=0xdc, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4615, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x4615, lpOverlapped=0x0) returned 1 [0265.892] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x4620, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x4620, lpOverlapped=0x0) returned 1 [0265.894] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0265.958] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0265.970] CloseHandle (hObject=0xdc) returned 1 [0265.970] CloseHandle (hObject=0xf8) returned 1 [0265.971] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\templates\\normal.dotm"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\templates\\normal.dotm.ozq0")) returned 0 [0265.971] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\templates\\normal.dotm.ozq0")) returned 0x2020 [0265.971] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b354e30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b354e30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b4aba90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x4615, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0x26dd88 [0265.972] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b354e30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b354e30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b4aba90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x4615, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0 [0265.972] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0265.972] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\templates\\normal.dotm")) returned 1 [0265.973] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Templates\\Normal.dotm" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\templates\\normal.dotm")) returned 0xffffffff [0265.973] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2b354e30, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x2b354e30, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x2b4aba90, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x4615, dwReserved0=0x342d3173, dwReserved1=0x2d626130, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 0 [0265.973] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0265.973] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x426ba7c0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426ba7c0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34343931, dwReserved1=0x33323232, cFileName="UProof", cAlternateFileName="")) returned 1 [0265.973] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x426ba7c0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426ba7c0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0265.974] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x426ba7c0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426ba7c0, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0265.974] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426ba7c0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426e0920, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0265.974] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0265.975] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xdc [0265.975] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0265.975] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0265.976] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0266.026] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18edd0*=0x18, lpOverlapped=0x0) returned 1 [0266.027] WriteFile (in: hFile=0xdc, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18edd0, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18edd0*=0x20, lpOverlapped=0x0) returned 1 [0266.028] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.097] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.110] CloseHandle (hObject=0xf8) returned 1 [0266.110] CloseHandle (hObject=0xdc) returned 1 [0266.110] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic.ozq0")) returned 0 [0266.111] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic.ozq0")) returned 0x2020 [0266.111] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC", lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426ba7c0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426e0920, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0x26dd88 [0266.111] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18eccc | out: lpFindFileData=0x18eccc*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426ba7c0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426e0920, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0266.112] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0266.112] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic")) returned 1 [0266.113] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\UProof\\CUSTOM.DIC" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\uproof\\custom.dic")) returned 0xffffffff [0266.113] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x426ba7c0, ftCreationTime.dwHighDateTime=0x1d7b065, ftLastAccessTime.dwLowDateTime=0x426ba7c0, ftLastAccessTime.dwHighDateTime=0x1d7b065, ftLastWriteTime.dwLowDateTime=0x426e0920, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 0 [0266.113] FindClose (in: hFindFile=0x26dd48 | out: hFindFile=0x26dd48) returned 1 [0266.113] FindNextFileA (in: hFindFile=0x26dcb0, lpFindFileData=0x18f2c0 | out: lpFindFileData=0x18f2c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x34343931, dwReserved1=0x33323232, cFileName="Windows", cAlternateFileName="")) returned 1 [0266.113] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\*.*", lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName=".", cAlternateFileName="")) returned 0x26dd48 [0266.114] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x794f55f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x795b3cd0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="..", cAlternateFileName="")) returned 1 [0266.114] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x76abed20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76abed20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653c7d, cFileName="Cookies", cAlternateFileName="")) returned 1 [0266.114] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x76abed20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76abed20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x276de8, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0266.114] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x795b3cd0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x76abed20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76abed20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e007c, dwReserved1=0x276de8, cFileName="..", cAlternateFileName="")) returned 1 [0266.114] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x577d0b90, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x7e007c, dwReserved1=0x276de8, cFileName="index.dat", cAlternateFileName="")) returned 1 [0266.115] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0266.115] CloseHandle (hObject=0xffffffff) returned 0 [0266.115] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.ozq0")) returned 0 [0266.115] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat.ozq0")) returned 0xffffffff [0266.115] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x577d0b90, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0x277e88 [0266.115] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x577d0b90, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0266.115] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0266.115] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 0 [0266.115] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\index.dat")) returned 0x2026 [0266.115] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76abed20, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76abed20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76abed20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="keecfmwgj@login.microsoftonline[2].txt", cAlternateFileName="KE130F~1.TXT")) returned 1 [0266.116] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@login.microsoftonline[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@login.microsoftonline[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0266.116] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@login.microsoftonline[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@login.microsoftonline[2].txt.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0266.117] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x199 [0266.117] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0266.118] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0266.165] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x199, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x199, lpOverlapped=0x0) returned 1 [0266.166] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1a0, lpOverlapped=0x0) returned 1 [0266.167] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.227] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.242] CloseHandle (hObject=0xf8) returned 1 [0266.242] CloseHandle (hObject=0xe0) returned 1 [0266.242] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@login.microsoftonline[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@login.microsoftonline[2].txt"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@login.microsoftonline[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@login.microsoftonline[2].txt.ozq0")) returned 0 [0266.243] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@login.microsoftonline[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@login.microsoftonline[2].txt.ozq0")) returned 0x2020 [0266.243] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@login.microsoftonline[2].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76abed20, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76abed20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76abed20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="keecfmwgj@login.microsoftonline[2].txt", cAlternateFileName="KE130F~1.TXT")) returned 0x277ec0 [0266.244] FindNextFileA (in: hFindFile=0x277ec0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76abed20, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76abed20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76abed20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x199, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="keecfmwgj@login.microsoftonline[2].txt", cAlternateFileName="KE130F~1.TXT")) returned 0 [0266.244] FindClose (in: hFindFile=0x277ec0 | out: hFindFile=0x277ec0) returned 1 [0266.244] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@login.microsoftonline[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@login.microsoftonline[2].txt")) returned 1 [0266.245] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@login.microsoftonline[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@login.microsoftonline[2].txt")) returned 0xffffffff [0266.245] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76a4c900, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76a4c900, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76a4c900, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="keecfmwgj@microsoft[2].txt", cAlternateFileName="KEECFM~4.TXT")) returned 1 [0266.246] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@microsoft[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@microsoft[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0266.247] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@microsoft[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@microsoft[2].txt.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0266.248] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf4 [0266.248] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0266.248] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0266.307] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xf4, lpOverlapped=0x0) returned 1 [0266.309] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x100, lpOverlapped=0x0) returned 1 [0266.311] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.378] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.394] CloseHandle (hObject=0xe0) returned 1 [0266.394] CloseHandle (hObject=0xf8) returned 1 [0266.394] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@microsoft[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@microsoft[2].txt"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@microsoft[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@microsoft[2].txt.ozq0")) returned 0 [0266.395] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@microsoft[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@microsoft[2].txt.ozq0")) returned 0x2020 [0266.395] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@microsoft[2].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76a4c900, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76a4c900, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76a4c900, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="keecfmwgj@microsoft[2].txt", cAlternateFileName="KEECFM~4.TXT")) returned 0x277ea8 [0266.395] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x76a4c900, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76a4c900, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76a4c900, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="keecfmwgj@microsoft[2].txt", cAlternateFileName="KEECFM~4.TXT")) returned 0 [0266.395] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0266.395] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@microsoft[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@microsoft[2].txt")) returned 1 [0266.397] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@microsoft[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@microsoft[2].txt")) returned 0xffffffff [0266.397] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x765178e0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76a4c900, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76a4c900, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="keecfmwgj@support.microsoft[2].txt", cAlternateFileName="KEECFM~2.TXT")) returned 1 [0266.397] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0266.398] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[2].txt.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0266.399] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x10c [0266.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0266.400] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0266.455] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x10c, lpOverlapped=0x0) returned 1 [0266.457] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x110, lpOverlapped=0x0) returned 1 [0266.458] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.523] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.534] CloseHandle (hObject=0xf8) returned 1 [0266.534] CloseHandle (hObject=0xe0) returned 1 [0266.534] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[2].txt"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[2].txt.ozq0")) returned 0 [0266.535] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[2].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[2].txt.ozq0")) returned 0x2020 [0266.535] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[2].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x765178e0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76a4c900, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76a4c900, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="keecfmwgj@support.microsoft[2].txt", cAlternateFileName="KEECFM~2.TXT")) returned 0x277eb8 [0266.535] FindNextFileA (in: hFindFile=0x277eb8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x765178e0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x76a4c900, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x76a4c900, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="keecfmwgj@support.microsoft[2].txt", cAlternateFileName="KEECFM~2.TXT")) returned 0 [0266.535] FindClose (in: hFindFile=0x277eb8 | out: hFindFile=0x277eb8) returned 1 [0266.535] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[2].txt")) returned 1 [0266.545] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[2].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[2].txt")) returned 0xffffffff [0266.545] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x765178e0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x765178e0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x765178e0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="keecfmwgj@support.microsoft[3].txt", cAlternateFileName="KEECFM~3.TXT")) returned 1 [0266.546] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[3].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[3].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0266.546] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[3].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[3].txt.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0266.547] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x226 [0266.548] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0266.548] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0266.597] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x226, lpOverlapped=0x0) returned 1 [0266.598] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x230, lpOverlapped=0x0) returned 1 [0266.599] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.658] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.670] CloseHandle (hObject=0xe0) returned 1 [0266.670] CloseHandle (hObject=0xf8) returned 1 [0266.671] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[3].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[3].txt"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[3].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[3].txt.ozq0")) returned 0 [0266.672] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[3].txt.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[3].txt.ozq0")) returned 0x2020 [0266.672] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[3].txt", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x765178e0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x765178e0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x765178e0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="keecfmwgj@support.microsoft[3].txt", cAlternateFileName="KEECFM~3.TXT")) returned 0x277eb8 [0266.672] FindNextFileA (in: hFindFile=0x277eb8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x765178e0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x765178e0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x765178e0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="keecfmwgj@support.microsoft[3].txt", cAlternateFileName="KEECFM~3.TXT")) returned 0 [0266.672] FindClose (in: hFindFile=0x277eb8 | out: hFindFile=0x277eb8) returned 1 [0266.672] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[3].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[3].txt")) returned 1 [0266.673] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\keecfmwgj@support.microsoft[3].txt" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\cookies\\keecfmwgj@support.microsoft[3].txt")) returned 0xffffffff [0266.673] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7cda41d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7cda41d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7cda41d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0266.673] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7cda41d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7cda41d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7cda41d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x277df0, cFileName=".", cAlternateFileName="")) returned 0x277e88 [0266.674] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7cda41d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7cda41d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7cda41d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 1 [0266.674] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7cda41d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7cda41d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7cda41d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 0 [0266.674] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0266.674] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7cda41d0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7cda41d0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7cda41d0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 0 [0266.674] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0266.674] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f707075, dwReserved1=0x6d2e7472, cFileName="IECompatCache", cAlternateFileName="IECOMP~1")) returned 1 [0266.674] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0266.675] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0266.675] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0266.675] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IECompatCache\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x277df0, cFileName=".", cAlternateFileName="")) returned 0x277df0 [0266.675] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 1 [0266.676] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc000be, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 0 [0266.676] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0266.676] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 0 [0266.676] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0266.676] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f707075, dwReserved1=0x6d2e7472, cFileName="IETldCache", cAlternateFileName="IETLDC~1")) returned 1 [0266.676] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0266.676] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xfe9256a4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0266.676] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x74e7e660, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="index.dat", cAlternateFileName="")) returned 1 [0266.677] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0266.677] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0266.678] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x40000 [0266.678] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0266.679] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0266.723] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x40000, lpOverlapped=0x0) returned 1 [0266.731] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x40010, lpOverlapped=0x0) returned 1 [0266.737] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.821] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0266.833] CloseHandle (hObject=0xf8) returned 1 [0266.833] CloseHandle (hObject=0xe0) returned 1 [0266.833] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.ozq0")) returned 0 [0266.834] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat.ozq0")) returned 0x2020 [0266.834] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x74e7e660, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0x277df0 [0266.834] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x74e7e660, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0266.834] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0266.834] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 1 [0266.837] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\ietldcache\\index.dat")) returned 0xffffffff [0266.837] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1 [0266.837] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\IETldCache\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x26bc50, cFileName=".", cAlternateFileName="")) returned 0x277e88 [0266.837] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x26bc50, cFileName="..", cAlternateFileName="")) returned 1 [0266.837] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x940092, dwReserved1=0x26bc50, cFileName="..", cAlternateFileName="")) returned 0 [0266.837] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0266.837] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7958db70, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0 [0266.837] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0266.837] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e87ab80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e87ab80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f707075, dwReserved1=0x6d2e7472, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0266.838] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e87ab80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e87ab80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0266.838] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0x7958db70, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e87ab80, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e87ab80, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0266.838] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e870f40, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0266.838] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0266.838] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0266.840] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x112 [0266.840] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0266.840] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0266.930] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x112, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x112, lpOverlapped=0x0) returned 1 [0266.930] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x120, lpOverlapped=0x0) returned 1 [0266.931] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0266.998] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.010] CloseHandle (hObject=0xe0) returned 1 [0267.010] CloseHandle (hObject=0xf8) returned 1 [0267.011] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.ozq0")) returned 0 [0267.012] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini.ozq0")) returned 0x2020 [0267.012] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e870f40, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277df0 [0267.012] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799de350, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e870f40, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0267.012] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0267.012] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 1 [0267.013] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\desktop.ini")) returned 0xffffffff [0267.014] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e819100, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e81b810, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 1 [0267.014] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0267.014] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0267.015] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdff [0267.015] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0267.016] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0267.064] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdff, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xdff, lpOverlapped=0x0) returned 1 [0267.064] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe00, lpOverlapped=0x0) returned 1 [0267.065] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.124] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.136] CloseHandle (hObject=0xf8) returned 1 [0267.136] CloseHandle (hObject=0xe0) returned 1 [0267.137] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.ozq0")) returned 0 [0267.137] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms.ozq0")) returned 0x2020 [0267.138] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e819100, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e81b810, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 0x277ea0 [0267.138] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799de350, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e819100, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e81b810, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdff, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Documents.library-ms", cAlternateFileName="DOCUME~1.LIB")) returned 0 [0267.138] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0267.138] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms")) returned 1 [0267.139] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Documents.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\documents.library-ms")) returned 0xffffffff [0267.139] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e873650, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e875d60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdd4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 1 [0267.140] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0267.140] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0267.141] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdd4 [0267.141] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0267.141] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0267.200] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdd4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xdd4, lpOverlapped=0x0) returned 1 [0267.201] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xde0, lpOverlapped=0x0) returned 1 [0267.202] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.259] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.272] CloseHandle (hObject=0xe0) returned 1 [0267.272] CloseHandle (hObject=0xf8) returned 1 [0267.273] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.ozq0")) returned 0 [0267.274] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms.ozq0")) returned 0x2020 [0267.274] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e873650, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e875d60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdd4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 0x277e98 [0267.274] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e873650, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e875d60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdd4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Music.library-ms", cAlternateFileName="MUSIC~1.LIB")) returned 0 [0267.274] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0267.274] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms")) returned 1 [0267.284] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Music.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\music.library-ms")) returned 0xffffffff [0267.284] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e840200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e842910, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdf7, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 1 [0267.284] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0267.284] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0267.286] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdf7 [0267.286] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0267.286] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0267.330] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdf7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xdf7, lpOverlapped=0x0) returned 1 [0267.331] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe00, lpOverlapped=0x0) returned 1 [0267.332] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.392] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.415] CloseHandle (hObject=0xf8) returned 1 [0267.415] CloseHandle (hObject=0xe0) returned 1 [0267.416] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.ozq0")) returned 0 [0267.417] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms.ozq0")) returned 0x2020 [0267.417] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e840200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e842910, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdf7, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 0x277ea0 [0267.417] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e840200, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e842910, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xdf7, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Pictures.library-ms", cAlternateFileName="PICTUR~1.LIB")) returned 0 [0267.417] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0267.417] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms")) returned 1 [0267.419] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Pictures.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\pictures.library-ms")) returned 0xffffffff [0267.419] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e8624e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e864bf0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xde2, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 1 [0267.419] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0267.419] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0267.421] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xde2 [0267.421] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0267.421] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0267.466] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xde2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xde2, lpOverlapped=0x0) returned 1 [0267.467] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xdf0, lpOverlapped=0x0) returned 1 [0267.468] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.581] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.593] CloseHandle (hObject=0xe0) returned 1 [0267.593] CloseHandle (hObject=0xf8) returned 1 [0267.594] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.ozq0")) returned 0 [0267.595] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms.ozq0")) returned 0x2020 [0267.595] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e8624e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e864bf0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xde2, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0x277ea0 [0267.596] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e8624e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e864bf0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xde2, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0267.596] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0267.596] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms")) returned 1 [0267.597] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\Videos.library-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\libraries\\videos.library-ms")) returned 0xffffffff [0267.597] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7e8624e0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e864bf0, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0xde2, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Videos.library-ms", cAlternateFileName="VIDEOS~1.LIB")) returned 0 [0267.597] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0267.597] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Network Shortcuts", cAlternateFileName="NETWOR~1")) returned 1 [0267.597] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0267.598] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0267.598] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xaeeef71c, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0267.598] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0267.598] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Printer Shortcuts", cAlternateFileName="PRINTE~1")) returned 1 [0267.598] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0267.598] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0267.598] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xb9c40b55, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 0 [0267.598] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0267.598] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x75cc2be0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x75cc2be0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="PrivacIE", cAlternateFileName="")) returned 1 [0267.598] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x75cc2be0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x75cc2be0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0267.599] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x75cc2be0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x75cc2be0, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0267.599] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x75cc2be0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x75cc2be0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x74e7e660, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="index.dat", cAlternateFileName="")) returned 1 [0267.599] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0267.600] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0267.601] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8000 [0267.601] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0267.601] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0267.647] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x8000, lpOverlapped=0x0) returned 1 [0267.671] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x8010, lpOverlapped=0x0) returned 1 [0267.673] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.724] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.736] CloseHandle (hObject=0xf8) returned 1 [0267.736] CloseHandle (hObject=0xe0) returned 1 [0267.736] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.ozq0")) returned 0 [0267.737] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat.ozq0")) returned 0x2020 [0267.737] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x75cc2be0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x75cc2be0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x74e7e660, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0x277e88 [0267.737] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x75cc2be0, ftCreationTime.dwHighDateTime=0x1d7b064, ftLastAccessTime.dwLowDateTime=0x75cc2be0, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x74e7e660, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="index.dat", cAlternateFileName="")) returned 0 [0267.737] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0267.737] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")) returned 1 [0267.738] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\index.dat" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\privacie\\index.dat")) returned 0xffffffff [0267.738] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 1 [0267.738] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Low\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x277df0, cFileName=".", cAlternateFileName="")) returned 0x277e88 [0267.739] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 1 [0267.739] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90008e, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 0 [0267.739] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0267.739] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x79567a10, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x79567a10, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0xedd0e6f6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Low", cAlternateFileName="")) returned 0 [0267.739] FindClose (in: hFindFile=0x26dd88 | out: hFindFile=0x26dd88) returned 1 [0267.739] FindNextFileA (in: hFindFile=0x26dd48, lpFindFileData=0x18f058 | out: lpFindFileData=0x18f058*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x625e2bc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625e2bc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2d797261, dwReserved1=0x736d736d, cFileName="Recent", cAlternateFileName="")) returned 1 [0267.739] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\*.*", lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x625e2bc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625e2bc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName=".", cAlternateFileName="")) returned 0x26dd88 [0267.739] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x625e2bc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625e2bc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="..", cAlternateFileName="")) returned 1 [0267.739] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612657a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612657a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612657a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1251, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="-dOlpY4.flv.lnk", cAlternateFileName="-DOLPY~1.LNK")) returned 1 [0267.740] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dOlpY4.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-dolpy4.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0267.740] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dOlpY4.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-dolpy4.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0267.741] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1251 [0267.741] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0267.741] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0267.789] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1251, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1251, lpOverlapped=0x0) returned 1 [0267.790] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1260, lpOverlapped=0x0) returned 1 [0267.791] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.845] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.856] CloseHandle (hObject=0xe0) returned 1 [0267.856] CloseHandle (hObject=0xf8) returned 1 [0267.857] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dOlpY4.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-dolpy4.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dOlpY4.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-dolpy4.flv.lnk.ozq0")) returned 0 [0267.857] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dOlpY4.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-dolpy4.flv.lnk.ozq0")) returned 0x20 [0267.857] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dOlpY4.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612657a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612657a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612657a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1251, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="-dOlpY4.flv.lnk", cAlternateFileName="-DOLPY~1.LNK")) returned 0x277df0 [0267.858] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612657a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612657a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612657a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1251, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="-dOlpY4.flv.lnk", cAlternateFileName="-DOLPY~1.LNK")) returned 0 [0267.858] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0267.858] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dOlpY4.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-dolpy4.flv.lnk")) returned 1 [0267.859] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-dOlpY4.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-dolpy4.flv.lnk")) returned 0xffffffff [0267.859] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ca9680, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x0, dwReserved1=0x0, cFileName="-FIg.lnk", cAlternateFileName="")) returned 1 [0267.859] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FIg.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-fig.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0267.860] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FIg.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-fig.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0267.862] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x283 [0267.862] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0267.862] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0267.907] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x283, lpOverlapped=0x0) returned 1 [0267.908] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x290, lpOverlapped=0x0) returned 1 [0267.911] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0267.967] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0267.980] CloseHandle (hObject=0xf8) returned 1 [0267.980] CloseHandle (hObject=0xe0) returned 1 [0267.980] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FIg.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-fig.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FIg.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-fig.lnk.ozq0")) returned 0 [0267.981] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FIg.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-fig.lnk.ozq0")) returned 0x20 [0267.981] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FIg.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ca9680, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="-FIg.lnk", cAlternateFileName="")) returned 0x277e88 [0267.981] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ca9680, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="-FIg.lnk", cAlternateFileName="")) returned 0 [0267.981] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0267.981] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FIg.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-fig.lnk")) returned 1 [0267.982] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-FIg.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-fig.lnk")) returned 0xffffffff [0267.983] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612d7bc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612d7bc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612d7bc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1407, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="-Hkn.lnk", cAlternateFileName="")) returned 1 [0267.983] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Hkn.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-hkn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0267.983] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Hkn.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-hkn.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0267.984] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1407 [0267.984] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0267.984] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0268.038] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1407, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1407, lpOverlapped=0x0) returned 1 [0268.039] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1410, lpOverlapped=0x0) returned 1 [0268.040] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.108] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.124] CloseHandle (hObject=0xe0) returned 1 [0268.124] CloseHandle (hObject=0xf8) returned 1 [0268.124] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Hkn.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-hkn.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Hkn.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-hkn.lnk.ozq0")) returned 0 [0268.125] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Hkn.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-hkn.lnk.ozq0")) returned 0x20 [0268.125] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Hkn.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612d7bc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612d7bc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612d7bc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1407, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="-Hkn.lnk", cAlternateFileName="")) returned 0x277e88 [0268.125] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612d7bc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612d7bc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612d7bc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1407, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="-Hkn.lnk", cAlternateFileName="")) returned 0 [0268.125] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0268.125] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Hkn.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-hkn.lnk")) returned 1 [0268.127] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-Hkn.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-hkn.lnk")) returned 0xffffffff [0268.127] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dec0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d8dec0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d8dec0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12e7, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="-WY hjepNwctLd.mkv.lnk", cAlternateFileName="-WYHJE~1.LNK")) returned 1 [0268.127] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-WY hjepNwctLd.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-wy hjepnwctld.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0268.127] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-WY hjepNwctLd.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-wy hjepnwctld.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0268.128] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12e7 [0268.128] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0268.129] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0268.179] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12e7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x12e7, lpOverlapped=0x0) returned 1 [0268.180] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x12f0, lpOverlapped=0x0) returned 1 [0268.181] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.235] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.248] CloseHandle (hObject=0xf8) returned 1 [0268.248] CloseHandle (hObject=0xe0) returned 1 [0268.248] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-WY hjepNwctLd.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-wy hjepnwctld.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-WY hjepNwctLd.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-wy hjepnwctld.mkv.lnk.ozq0")) returned 0 [0268.249] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-WY hjepNwctLd.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-wy hjepnwctld.mkv.lnk.ozq0")) returned 0x20 [0268.249] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-WY hjepNwctLd.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dec0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d8dec0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d8dec0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12e7, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="-WY hjepNwctLd.mkv.lnk", cAlternateFileName="-WYHJE~1.LNK")) returned 0x277ea0 [0268.249] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d8dec0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d8dec0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d8dec0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12e7, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="-WY hjepNwctLd.mkv.lnk", cAlternateFileName="-WYHJE~1.LNK")) returned 0 [0268.249] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0268.249] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-WY hjepNwctLd.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-wy hjepnwctld.mkv.lnk")) returned 1 [0268.251] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-WY hjepNwctLd.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-wy hjepnwctld.mkv.lnk")) returned 0xffffffff [0268.251] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61832d40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61832d40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61832d40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe95, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="-_ CX4K.lnk", cAlternateFileName="-_CX4K~1.LNK")) returned 1 [0268.251] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-_ CX4K.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-_ cx4k.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0268.252] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-_ CX4K.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-_ cx4k.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0268.253] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe95 [0268.253] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0268.253] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0268.317] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe95, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe95, lpOverlapped=0x0) returned 1 [0268.318] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xea0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xea0, lpOverlapped=0x0) returned 1 [0268.319] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.372] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.394] CloseHandle (hObject=0xe0) returned 1 [0268.394] CloseHandle (hObject=0xf8) returned 1 [0268.395] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-_ CX4K.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-_ cx4k.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-_ CX4K.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-_ cx4k.lnk.ozq0")) returned 0 [0268.396] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-_ CX4K.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-_ cx4k.lnk.ozq0")) returned 0x20 [0268.396] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-_ CX4K.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61832d40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61832d40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61832d40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe95, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="-_ CX4K.lnk", cAlternateFileName="-_CX4K~1.LNK")) returned 0x277e88 [0268.396] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61832d40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61832d40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61832d40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe95, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="-_ CX4K.lnk", cAlternateFileName="-_CX4K~1.LNK")) returned 0 [0268.396] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0268.396] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-_ CX4K.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-_ cx4k.lnk")) returned 1 [0268.397] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\-_ CX4K.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\-_ cx4k.lnk")) returned 0xffffffff [0268.397] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618cb2c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618cb2c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618cb2c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="07Kjy076tekIhqO6LPED.lnk", cAlternateFileName="07KJY0~1.LNK")) returned 1 [0268.398] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07Kjy076tekIhqO6LPED.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\07kjy076tekihqo6lped.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0268.398] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07Kjy076tekIhqO6LPED.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\07kjy076tekihqo6lped.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0268.399] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x254 [0268.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0268.399] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0268.449] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x254, lpOverlapped=0x0) returned 1 [0268.450] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x260, lpOverlapped=0x0) returned 1 [0268.451] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.511] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.523] CloseHandle (hObject=0xf8) returned 1 [0268.523] CloseHandle (hObject=0xe0) returned 1 [0268.523] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07Kjy076tekIhqO6LPED.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\07kjy076tekihqo6lped.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07Kjy076tekIhqO6LPED.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\07kjy076tekihqo6lped.lnk.ozq0")) returned 0 [0268.524] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07Kjy076tekIhqO6LPED.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\07kjy076tekihqo6lped.lnk.ozq0")) returned 0x20 [0268.524] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07Kjy076tekIhqO6LPED.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618cb2c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618cb2c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618cb2c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="07Kjy076tekIhqO6LPED.lnk", cAlternateFileName="07KJY0~1.LNK")) returned 0x277ea8 [0268.524] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618cb2c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618cb2c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618cb2c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="07Kjy076tekIhqO6LPED.lnk", cAlternateFileName="07KJY0~1.LNK")) returned 0 [0268.524] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0268.525] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07Kjy076tekIhqO6LPED.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\07kjy076tekihqo6lped.lnk")) returned 1 [0268.526] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\07Kjy076tekIhqO6LPED.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\07kjy076tekihqo6lped.lnk")) returned 0xffffffff [0268.526] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e6a8360, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61db4020, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61db4020, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="0FF39G 1Ls10eKo.lnk", cAlternateFileName="0FF39G~1.LNK")) returned 1 [0268.526] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0FF39G 1Ls10eKo.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0ff39g 1ls10eko.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0268.526] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0FF39G 1Ls10eKo.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0ff39g 1ls10eko.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0268.527] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ed [0268.527] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0268.528] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0268.573] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1ed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1ed, lpOverlapped=0x0) returned 1 [0268.573] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1f0, lpOverlapped=0x0) returned 1 [0268.574] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.639] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.650] CloseHandle (hObject=0xe0) returned 1 [0268.650] CloseHandle (hObject=0xf8) returned 1 [0268.650] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0FF39G 1Ls10eKo.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0ff39g 1ls10eko.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0FF39G 1Ls10eKo.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0ff39g 1ls10eko.lnk.ozq0")) returned 0 [0268.651] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0FF39G 1Ls10eKo.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0ff39g 1ls10eko.lnk.ozq0")) returned 0x20 [0268.651] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0FF39G 1Ls10eKo.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e6a8360, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61db4020, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61db4020, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="0FF39G 1Ls10eKo.lnk", cAlternateFileName="0FF39G~1.LNK")) returned 0x277e98 [0268.651] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e6a8360, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61db4020, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61db4020, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="0FF39G 1Ls10eKo.lnk", cAlternateFileName="0FF39G~1.LNK")) returned 0 [0268.651] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0268.651] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0FF39G 1Ls10eKo.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0ff39g 1ls10eko.lnk")) returned 1 [0268.652] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0FF39G 1Ls10eKo.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0ff39g 1ls10eko.lnk")) returned 0xffffffff [0268.652] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f0ac80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f0ac80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f0ac80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1990, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="0joO9ilmvgQC1s L.lnk", cAlternateFileName="0JOO9I~1.LNK")) returned 1 [0268.653] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0joO9ilmvgQC1s L.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0joo9ilmvgqc1s l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0268.653] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0joO9ilmvgQC1s L.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0joo9ilmvgqc1s l.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0268.654] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1990 [0268.654] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0268.654] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0268.700] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1990, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1990, lpOverlapped=0x0) returned 1 [0268.701] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x19a0, lpOverlapped=0x0) returned 1 [0268.702] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.763] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.777] CloseHandle (hObject=0xf8) returned 1 [0268.777] CloseHandle (hObject=0xe0) returned 1 [0268.778] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0joO9ilmvgQC1s L.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0joo9ilmvgqc1s l.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0joO9ilmvgQC1s L.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0joo9ilmvgqc1s l.lnk.ozq0")) returned 0 [0268.778] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0joO9ilmvgQC1s L.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0joo9ilmvgqc1s l.lnk.ozq0")) returned 0x20 [0268.779] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0joO9ilmvgQC1s L.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f0ac80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f0ac80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f0ac80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1990, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="0joO9ilmvgQC1s L.lnk", cAlternateFileName="0JOO9I~1.LNK")) returned 0x277ea0 [0268.779] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f0ac80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f0ac80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f0ac80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1990, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="0joO9ilmvgQC1s L.lnk", cAlternateFileName="0JOO9I~1.LNK")) returned 0 [0268.779] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0268.779] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0joO9ilmvgQC1s L.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0joo9ilmvgqc1s l.lnk")) returned 1 [0268.780] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0joO9ilmvgQC1s L.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0joo9ilmvgqc1s l.lnk")) returned 0xffffffff [0268.780] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c720a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60c720a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60c720a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="0k8M.swf.lnk", cAlternateFileName="0K8MSW~1.LNK")) returned 1 [0268.780] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k8M.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0k8m.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0268.781] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k8M.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0k8m.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0268.782] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x283 [0268.782] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0268.782] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0268.829] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x283, lpOverlapped=0x0) returned 1 [0268.830] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x290, lpOverlapped=0x0) returned 1 [0268.832] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0268.895] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0268.907] CloseHandle (hObject=0xe0) returned 1 [0268.907] CloseHandle (hObject=0xf8) returned 1 [0268.907] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k8M.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0k8m.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k8M.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0k8m.swf.lnk.ozq0")) returned 0 [0268.908] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k8M.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0k8m.swf.lnk.ozq0")) returned 0x20 [0268.908] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k8M.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c720a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60c720a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60c720a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="0k8M.swf.lnk", cAlternateFileName="0K8MSW~1.LNK")) returned 0x277df0 [0268.908] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c720a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60c720a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60c720a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="0k8M.swf.lnk", cAlternateFileName="0K8MSW~1.LNK")) returned 0 [0268.908] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0268.908] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k8M.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0k8m.swf.lnk")) returned 1 [0268.909] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\0k8M.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\0k8m.swf.lnk")) returned 0xffffffff [0268.909] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eaf8b40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="1CYz_EgO.lnk", cAlternateFileName="")) returned 1 [0268.910] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CYz_EgO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1cyz_ego.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0268.910] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CYz_EgO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1cyz_ego.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0268.911] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1ca [0268.911] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0268.911] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0268.959] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1ca, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1ca, lpOverlapped=0x0) returned 1 [0268.960] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1d0, lpOverlapped=0x0) returned 1 [0268.961] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.068] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.084] CloseHandle (hObject=0xf8) returned 1 [0269.084] CloseHandle (hObject=0xe0) returned 1 [0269.085] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CYz_EgO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1cyz_ego.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CYz_EgO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1cyz_ego.lnk.ozq0")) returned 0 [0269.086] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CYz_EgO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1cyz_ego.lnk.ozq0")) returned 0x20 [0269.086] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CYz_EgO.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eaf8b40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="1CYz_EgO.lnk", cAlternateFileName="")) returned 0x277df0 [0269.086] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eaf8b40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1ca, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="1CYz_EgO.lnk", cAlternateFileName="")) returned 0 [0269.086] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0269.086] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CYz_EgO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1cyz_ego.lnk")) returned 1 [0269.087] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1CYz_EgO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1cyz_ego.lnk")) returned 0xffffffff [0269.087] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619899a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619899a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619899a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Ew4dbzrRp.lnk", cAlternateFileName="1EW4DB~1.LNK")) returned 1 [0269.088] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1Ew4dbzrRp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1ew4dbzrrp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0269.088] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1Ew4dbzrRp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1ew4dbzrrp.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0269.089] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13aa [0269.089] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0269.089] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0269.155] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13aa, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x13aa, lpOverlapped=0x0) returned 1 [0269.156] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x13b0, lpOverlapped=0x0) returned 1 [0269.157] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.221] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.233] CloseHandle (hObject=0xe0) returned 1 [0269.234] CloseHandle (hObject=0xf8) returned 1 [0269.234] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1Ew4dbzrRp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1ew4dbzrrp.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1Ew4dbzrRp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1ew4dbzrrp.lnk.ozq0")) returned 0 [0269.235] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1Ew4dbzrRp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1ew4dbzrrp.lnk.ozq0")) returned 0x20 [0269.235] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1Ew4dbzrRp.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619899a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619899a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619899a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13aa, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1Ew4dbzrRp.lnk", cAlternateFileName="1EW4DB~1.LNK")) returned 0x277df0 [0269.235] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619899a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619899a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619899a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13aa, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1Ew4dbzrRp.lnk", cAlternateFileName="1EW4DB~1.LNK")) returned 0 [0269.235] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0269.235] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1Ew4dbzrRp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1ew4dbzrrp.lnk")) returned 1 [0269.236] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1Ew4dbzrRp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1ew4dbzrrp.lnk")) returned 0xffffffff [0269.236] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618a5160, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618a5160, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618a5160, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="1i hbo6PV0xTI.lnk", cAlternateFileName="1IHBO6~1.LNK")) returned 1 [0269.237] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1i hbo6PV0xTI.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1i hbo6pv0xti.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0269.237] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1i hbo6PV0xTI.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1i hbo6pv0xti.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0269.238] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ea [0269.238] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0269.239] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0269.289] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9ea, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9ea, lpOverlapped=0x0) returned 1 [0269.289] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9f0, lpOverlapped=0x0) returned 1 [0269.290] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.353] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.367] CloseHandle (hObject=0xf8) returned 1 [0269.368] CloseHandle (hObject=0xe0) returned 1 [0269.368] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1i hbo6PV0xTI.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1i hbo6pv0xti.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1i hbo6PV0xTI.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1i hbo6pv0xti.lnk.ozq0")) returned 0 [0269.368] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1i hbo6PV0xTI.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1i hbo6pv0xti.lnk.ozq0")) returned 0x20 [0269.369] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1i hbo6PV0xTI.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618a5160, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618a5160, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618a5160, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="1i hbo6PV0xTI.lnk", cAlternateFileName="1IHBO6~1.LNK")) returned 0x277e98 [0269.369] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618a5160, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618a5160, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618a5160, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="1i hbo6PV0xTI.lnk", cAlternateFileName="1IHBO6~1.LNK")) returned 0 [0269.369] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0269.369] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1i hbo6PV0xTI.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1i hbo6pv0xti.lnk")) returned 1 [0269.370] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1i hbo6PV0xTI.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1i hbo6pv0xti.lnk")) returned 0xffffffff [0269.370] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61774660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61774660, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61774660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xda8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="1lPJqE.mkv.lnk", cAlternateFileName="1LPJQE~1.LNK")) returned 1 [0269.371] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lPJqE.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1lpjqe.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0269.371] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lPJqE.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1lpjqe.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0269.372] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xda8 [0269.372] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0269.373] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0269.444] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xda8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xda8, lpOverlapped=0x0) returned 1 [0269.445] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xdb0, lpOverlapped=0x0) returned 1 [0269.447] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.507] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.520] CloseHandle (hObject=0xe0) returned 1 [0269.520] CloseHandle (hObject=0xf8) returned 1 [0269.520] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lPJqE.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1lpjqe.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lPJqE.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1lpjqe.mkv.lnk.ozq0")) returned 0 [0269.521] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lPJqE.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1lpjqe.mkv.lnk.ozq0")) returned 0x20 [0269.521] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lPJqE.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61774660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61774660, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61774660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xda8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1lPJqE.mkv.lnk", cAlternateFileName="1LPJQE~1.LNK")) returned 0x277df0 [0269.521] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61774660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61774660, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61774660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xda8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1lPJqE.mkv.lnk", cAlternateFileName="1LPJQE~1.LNK")) returned 0 [0269.521] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0269.521] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lPJqE.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1lpjqe.mkv.lnk")) returned 1 [0269.522] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\1lPJqE.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\1lpjqe.mkv.lnk")) returned 0xffffffff [0269.522] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604dba80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x604dba80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x604dba80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x144e, dwReserved0=0x0, dwReserved1=0x0, cFileName="21ocoqUa0LRMv2u7CxC.lnk", cAlternateFileName="21OCOQ~1.LNK")) returned 1 [0269.523] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\21ocoqUa0LRMv2u7CxC.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\21ocoqua0lrmv2u7cxc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0269.523] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\21ocoqUa0LRMv2u7CxC.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\21ocoqua0lrmv2u7cxc.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0269.524] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x144e [0269.524] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0269.525] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0269.573] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x144e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x144e, lpOverlapped=0x0) returned 1 [0269.574] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1450, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1450, lpOverlapped=0x0) returned 1 [0269.575] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.634] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.646] CloseHandle (hObject=0xf8) returned 1 [0269.646] CloseHandle (hObject=0xe0) returned 1 [0269.646] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\21ocoqUa0LRMv2u7CxC.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\21ocoqua0lrmv2u7cxc.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\21ocoqUa0LRMv2u7CxC.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\21ocoqua0lrmv2u7cxc.lnk.ozq0")) returned 0 [0269.647] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\21ocoqUa0LRMv2u7CxC.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\21ocoqua0lrmv2u7cxc.lnk.ozq0")) returned 0x20 [0269.647] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\21ocoqUa0LRMv2u7CxC.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604dba80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x604dba80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x604dba80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x144e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="21ocoqUa0LRMv2u7CxC.lnk", cAlternateFileName="21OCOQ~1.LNK")) returned 0x277ea0 [0269.647] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604dba80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x604dba80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x604dba80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x144e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="21ocoqUa0LRMv2u7CxC.lnk", cAlternateFileName="21OCOQ~1.LNK")) returned 0 [0269.647] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0269.647] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\21ocoqUa0LRMv2u7CxC.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\21ocoqua0lrmv2u7cxc.lnk")) returned 1 [0269.648] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\21ocoqUa0LRMv2u7CxC.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\21ocoqua0lrmv2u7cxc.lnk")) returned 0xffffffff [0269.648] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621923e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x621923e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x621923e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1405, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="261GrrEF5y r.lnk", cAlternateFileName="261GRR~1.LNK")) returned 1 [0269.649] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\261GrrEF5y r.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\261grref5y r.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0269.649] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\261GrrEF5y r.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\261grref5y r.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0269.650] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1405 [0269.650] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0269.650] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0269.694] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1405, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1405, lpOverlapped=0x0) returned 1 [0269.695] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1410, lpOverlapped=0x0) returned 1 [0269.696] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.747] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.759] CloseHandle (hObject=0xe0) returned 1 [0269.759] CloseHandle (hObject=0xf8) returned 1 [0269.759] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\261GrrEF5y r.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\261grref5y r.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\261GrrEF5y r.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\261grref5y r.lnk.ozq0")) returned 0 [0269.760] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\261GrrEF5y r.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\261grref5y r.lnk.ozq0")) returned 0x20 [0269.760] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\261GrrEF5y r.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621923e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x621923e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x621923e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1405, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="261GrrEF5y r.lnk", cAlternateFileName="261GRR~1.LNK")) returned 0x277e98 [0269.760] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621923e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x621923e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x621923e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1405, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="261GrrEF5y r.lnk", cAlternateFileName="261GRR~1.LNK")) returned 0 [0269.760] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0269.760] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\261GrrEF5y r.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\261grref5y r.lnk")) returned 1 [0269.761] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\261GrrEF5y r.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\261grref5y r.lnk")) returned 0xffffffff [0269.761] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d41c00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d41c00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d41c00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="2j_115.lnk", cAlternateFileName="")) returned 1 [0269.762] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2j_115.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2j_115.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0269.762] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2j_115.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2j_115.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0269.763] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a5 [0269.763] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0269.763] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0269.808] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3a5, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3a5, lpOverlapped=0x0) returned 1 [0269.808] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3b0, lpOverlapped=0x0) returned 1 [0269.809] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.861] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.874] CloseHandle (hObject=0xf8) returned 1 [0269.874] CloseHandle (hObject=0xe0) returned 1 [0269.875] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2j_115.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2j_115.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2j_115.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2j_115.lnk.ozq0")) returned 0 [0269.876] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2j_115.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2j_115.lnk.ozq0")) returned 0x20 [0269.876] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2j_115.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d41c00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d41c00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d41c00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2j_115.lnk", cAlternateFileName="")) returned 0x277e88 [0269.876] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d41c00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d41c00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d41c00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="2j_115.lnk", cAlternateFileName="")) returned 0 [0269.876] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0269.876] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2j_115.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2j_115.lnk")) returned 1 [0269.877] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2j_115.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2j_115.lnk")) returned 0xffffffff [0269.877] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619d5c60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619d5c60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619d5c60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xf1b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="2PlLNH ZpBO7LT.lnk", cAlternateFileName="2PLLNH~1.LNK")) returned 1 [0269.878] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PlLNH ZpBO7LT.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2pllnh zpbo7lt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0269.878] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PlLNH ZpBO7LT.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2pllnh zpbo7lt.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0269.879] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf1b [0269.879] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0269.879] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0269.928] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf1b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xf1b, lpOverlapped=0x0) returned 1 [0269.929] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf20, lpOverlapped=0x0) returned 1 [0269.930] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0269.983] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0269.995] CloseHandle (hObject=0xe0) returned 1 [0269.995] CloseHandle (hObject=0xf8) returned 1 [0269.996] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PlLNH ZpBO7LT.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2pllnh zpbo7lt.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PlLNH ZpBO7LT.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2pllnh zpbo7lt.lnk.ozq0")) returned 0 [0269.997] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PlLNH ZpBO7LT.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2pllnh zpbo7lt.lnk.ozq0")) returned 0x20 [0269.997] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PlLNH ZpBO7LT.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619d5c60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619d5c60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619d5c60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xf1b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="2PlLNH ZpBO7LT.lnk", cAlternateFileName="2PLLNH~1.LNK")) returned 0x277e98 [0269.997] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619d5c60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619d5c60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619d5c60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xf1b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="2PlLNH ZpBO7LT.lnk", cAlternateFileName="2PLLNH~1.LNK")) returned 0 [0269.997] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0269.997] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PlLNH ZpBO7LT.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2pllnh zpbo7lt.lnk")) returned 1 [0269.998] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\2PlLNH ZpBO7LT.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\2pllnh zpbo7lt.lnk")) returned 0xffffffff [0269.998] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a5cd60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623f39e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623f39e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12ba, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="5Aaw.lnk", cAlternateFileName="")) returned 1 [0269.999] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Aaw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5aaw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0269.999] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Aaw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5aaw.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0270.000] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ba [0270.000] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0270.000] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0270.047] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ba, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x12ba, lpOverlapped=0x0) returned 1 [0270.047] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x12c0, lpOverlapped=0x0) returned 1 [0270.049] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.100] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.112] CloseHandle (hObject=0xf8) returned 1 [0270.112] CloseHandle (hObject=0xe0) returned 1 [0270.112] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Aaw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5aaw.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Aaw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5aaw.lnk.ozq0")) returned 0 [0270.113] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Aaw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5aaw.lnk.ozq0")) returned 0x20 [0270.113] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Aaw.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a5cd60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623f39e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623f39e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12ba, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="5Aaw.lnk", cAlternateFileName="")) returned 0x277e88 [0270.113] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a5cd60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623f39e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623f39e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12ba, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="5Aaw.lnk", cAlternateFileName="")) returned 0 [0270.113] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0270.113] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Aaw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5aaw.lnk")) returned 1 [0270.114] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5Aaw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5aaw.lnk")) returned 0xffffffff [0270.114] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60443500, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e4c5a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e4c5a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x98d, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="5lsgTUK-lWrp2LY-l.lnk", cAlternateFileName="5LSGTU~1.LNK")) returned 1 [0270.115] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lsgTUK-lWrp2LY-l.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5lsgtuk-lwrp2ly-l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0270.115] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lsgTUK-lWrp2LY-l.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5lsgtuk-lwrp2ly-l.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0270.116] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x98d [0270.116] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0270.116] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0270.160] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x98d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x98d, lpOverlapped=0x0) returned 1 [0270.160] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x990, lpOverlapped=0x0) returned 1 [0270.161] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.213] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.225] CloseHandle (hObject=0xe0) returned 1 [0270.226] CloseHandle (hObject=0xf8) returned 1 [0270.226] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lsgTUK-lWrp2LY-l.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5lsgtuk-lwrp2ly-l.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lsgTUK-lWrp2LY-l.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5lsgtuk-lwrp2ly-l.lnk.ozq0")) returned 0 [0270.227] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lsgTUK-lWrp2LY-l.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5lsgtuk-lwrp2ly-l.lnk.ozq0")) returned 0x20 [0270.227] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lsgTUK-lWrp2LY-l.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60443500, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e4c5a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e4c5a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x98d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="5lsgTUK-lWrp2LY-l.lnk", cAlternateFileName="5LSGTU~1.LNK")) returned 0x277ea0 [0270.227] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60443500, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e4c5a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e4c5a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x98d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="5lsgTUK-lWrp2LY-l.lnk", cAlternateFileName="5LSGTU~1.LNK")) returned 0 [0270.227] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0270.227] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lsgTUK-lWrp2LY-l.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5lsgtuk-lwrp2ly-l.lnk")) returned 1 [0270.228] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\5lsgTUK-lWrp2LY-l.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\5lsgtuk-lwrp2ly-l.lnk")) returned 0xffffffff [0270.228] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x625bca60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625bca60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625bca60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="6FUsCBL.mkv.lnk", cAlternateFileName="6FUSCB~1.LNK")) returned 1 [0270.229] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6FUsCBL.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6fuscbl.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0270.229] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6FUsCBL.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6fuscbl.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0270.230] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x211 [0270.230] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0270.230] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0270.278] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x211, lpOverlapped=0x0) returned 1 [0270.280] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x220, lpOverlapped=0x0) returned 1 [0270.281] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.350] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.381] CloseHandle (hObject=0xf8) returned 1 [0270.381] CloseHandle (hObject=0xe0) returned 1 [0270.382] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6FUsCBL.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6fuscbl.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6FUsCBL.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6fuscbl.mkv.lnk.ozq0")) returned 0 [0270.382] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6FUsCBL.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6fuscbl.mkv.lnk.ozq0")) returned 0x20 [0270.382] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6FUsCBL.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x625bca60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625bca60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625bca60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="6FUsCBL.mkv.lnk", cAlternateFileName="6FUSCB~1.LNK")) returned 0x277df0 [0270.383] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x625bca60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625bca60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625bca60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="6FUsCBL.mkv.lnk", cAlternateFileName="6FUSCB~1.LNK")) returned 0 [0270.383] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0270.383] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6FUsCBL.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6fuscbl.mkv.lnk")) returned 1 [0270.384] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6FUsCBL.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6fuscbl.mkv.lnk")) returned 0xffffffff [0270.384] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x610e89e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624b20c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624b20c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe49, dwReserved0=0x0, dwReserved1=0x0, cFileName="6wjVEDKL9.lnk", cAlternateFileName="6WJVED~1.LNK")) returned 1 [0270.384] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6wjVEDKL9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6wjvedkl9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0270.384] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6wjVEDKL9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6wjvedkl9.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0270.386] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe49 [0270.386] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0270.386] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0270.448] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe49, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe49, lpOverlapped=0x0) returned 1 [0270.448] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe50, lpOverlapped=0x0) returned 1 [0270.449] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.510] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.533] CloseHandle (hObject=0xe0) returned 1 [0270.533] CloseHandle (hObject=0xf8) returned 1 [0270.533] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6wjVEDKL9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6wjvedkl9.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6wjVEDKL9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6wjvedkl9.lnk.ozq0")) returned 0 [0270.534] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6wjVEDKL9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6wjvedkl9.lnk.ozq0")) returned 0x20 [0270.534] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6wjVEDKL9.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x610e89e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624b20c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624b20c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe49, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="6wjVEDKL9.lnk", cAlternateFileName="6WJVED~1.LNK")) returned 0x277df0 [0270.534] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x610e89e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624b20c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624b20c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe49, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="6wjVEDKL9.lnk", cAlternateFileName="6WJVED~1.LNK")) returned 0 [0270.534] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0270.534] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6wjVEDKL9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6wjvedkl9.lnk")) returned 1 [0270.536] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6wjVEDKL9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6wjvedkl9.lnk")) returned 0xffffffff [0270.536] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ed36a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ed36a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ed36a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xf30, dwReserved0=0x0, dwReserved1=0x0, cFileName="6yrlzdVAdSS0zRayMsx.lnk", cAlternateFileName="6YRLZD~1.LNK")) returned 1 [0270.536] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6yrlzdVAdSS0zRayMsx.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6yrlzdvadss0zraymsx.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0270.536] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6yrlzdVAdSS0zRayMsx.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6yrlzdvadss0zraymsx.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0270.537] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xf30 [0270.538] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0270.538] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0270.587] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xf30, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xf30, lpOverlapped=0x0) returned 1 [0270.592] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xf40, lpOverlapped=0x0) returned 1 [0270.592] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.654] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.669] CloseHandle (hObject=0xf8) returned 1 [0270.669] CloseHandle (hObject=0xe0) returned 1 [0270.669] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6yrlzdVAdSS0zRayMsx.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6yrlzdvadss0zraymsx.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6yrlzdVAdSS0zRayMsx.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6yrlzdvadss0zraymsx.lnk.ozq0")) returned 0 [0270.670] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6yrlzdVAdSS0zRayMsx.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6yrlzdvadss0zraymsx.lnk.ozq0")) returned 0x20 [0270.670] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6yrlzdVAdSS0zRayMsx.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ed36a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ed36a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ed36a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xf30, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="6yrlzdVAdSS0zRayMsx.lnk", cAlternateFileName="6YRLZD~1.LNK")) returned 0x277ea0 [0270.670] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ed36a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ed36a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ed36a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xf30, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="6yrlzdVAdSS0zRayMsx.lnk", cAlternateFileName="6YRLZD~1.LNK")) returned 0 [0270.670] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0270.670] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6yrlzdVAdSS0zRayMsx.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6yrlzdvadss0zraymsx.lnk")) returned 1 [0270.672] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\6yrlzdVAdSS0zRayMsx.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\6yrlzdvadss0zraymsx.lnk")) returned 0xffffffff [0270.672] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6230f1a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6230f1a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6230f1a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="7 RSpZL_x.lnk", cAlternateFileName="7RSPZL~1.LNK")) returned 1 [0270.672] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 RSpZL_x.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7 rspzl_x.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0270.672] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 RSpZL_x.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7 rspzl_x.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0270.674] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee0 [0270.674] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0270.674] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0270.723] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xee0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xee0, lpOverlapped=0x0) returned 1 [0270.724] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xef0, lpOverlapped=0x0) returned 1 [0270.725] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.787] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.801] CloseHandle (hObject=0xe0) returned 1 [0270.801] CloseHandle (hObject=0xf8) returned 1 [0270.801] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 RSpZL_x.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7 rspzl_x.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 RSpZL_x.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7 rspzl_x.lnk.ozq0")) returned 0 [0270.802] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 RSpZL_x.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7 rspzl_x.lnk.ozq0")) returned 0x20 [0270.802] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 RSpZL_x.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6230f1a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6230f1a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6230f1a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="7 RSpZL_x.lnk", cAlternateFileName="7RSPZL~1.LNK")) returned 0x277df0 [0270.802] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6230f1a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6230f1a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6230f1a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="7 RSpZL_x.lnk", cAlternateFileName="7RSPZL~1.LNK")) returned 0 [0270.802] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0270.802] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 RSpZL_x.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7 rspzl_x.lnk")) returned 1 [0270.803] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7 RSpZL_x.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7 rspzl_x.lnk")) returned 0xffffffff [0270.803] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62596900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62596900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62596900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x0, dwReserved1=0x0, cFileName="7Gf8YQniHsP.lnk", cAlternateFileName="7GF8YQ~1.LNK")) returned 1 [0270.804] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Gf8YQniHsP.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7gf8yqnihsp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0270.804] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Gf8YQniHsP.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7gf8yqnihsp.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0270.805] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9be [0270.805] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0270.805] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0270.856] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9be, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9be, lpOverlapped=0x0) returned 1 [0270.859] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9c0, lpOverlapped=0x0) returned 1 [0270.860] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0270.923] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0270.939] CloseHandle (hObject=0xf8) returned 1 [0270.939] CloseHandle (hObject=0xe0) returned 1 [0270.940] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Gf8YQniHsP.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7gf8yqnihsp.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Gf8YQniHsP.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7gf8yqnihsp.lnk.ozq0")) returned 0 [0270.941] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Gf8YQniHsP.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7gf8yqnihsp.lnk.ozq0")) returned 0x20 [0270.941] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Gf8YQniHsP.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62596900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62596900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62596900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="7Gf8YQniHsP.lnk", cAlternateFileName="7GF8YQ~1.LNK")) returned 0x277df0 [0270.941] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62596900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62596900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62596900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9be, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="7Gf8YQniHsP.lnk", cAlternateFileName="7GF8YQ~1.LNK")) returned 0 [0270.941] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0270.941] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Gf8YQniHsP.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7gf8yqnihsp.lnk")) returned 1 [0270.943] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7Gf8YQniHsP.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7gf8yqnihsp.lnk")) returned 0xffffffff [0270.943] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62204800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62204800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62204800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="7RfwWe I-Hm.lnk", cAlternateFileName="7RFWWE~1.LNK")) returned 1 [0270.943] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7RfwWe I-Hm.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7rfwwe i-hm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0270.943] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7RfwWe I-Hm.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7rfwwe i-hm.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0270.945] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9c9 [0270.945] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0270.945] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0270.998] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9c9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9c9, lpOverlapped=0x0) returned 1 [0270.999] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9d0, lpOverlapped=0x0) returned 1 [0271.001] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.062] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.076] CloseHandle (hObject=0xe0) returned 1 [0271.076] CloseHandle (hObject=0xf8) returned 1 [0271.076] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7RfwWe I-Hm.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7rfwwe i-hm.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7RfwWe I-Hm.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7rfwwe i-hm.lnk.ozq0")) returned 0 [0271.077] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7RfwWe I-Hm.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7rfwwe i-hm.lnk.ozq0")) returned 0x20 [0271.077] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7RfwWe I-Hm.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62204800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62204800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62204800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9c9, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="7RfwWe I-Hm.lnk", cAlternateFileName="7RFWWE~1.LNK")) returned 0x277df0 [0271.077] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62204800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62204800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62204800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9c9, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="7RfwWe I-Hm.lnk", cAlternateFileName="7RFWWE~1.LNK")) returned 0 [0271.077] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0271.077] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7RfwWe I-Hm.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7rfwwe i-hm.lnk")) returned 1 [0271.078] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7RfwWe I-Hm.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7rfwwe i-hm.lnk")) returned 0xffffffff [0271.078] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e873e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e873e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ead540, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="7ZRl4.swf.lnk", cAlternateFileName="7ZRL4S~1.LNK")) returned 1 [0271.079] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7ZRl4.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7zrl4.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0271.079] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7ZRl4.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7zrl4.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0271.080] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd4d [0271.080] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0271.080] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0271.132] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd4d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd4d, lpOverlapped=0x0) returned 1 [0271.133] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd50, lpOverlapped=0x0) returned 1 [0271.134] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.197] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.219] CloseHandle (hObject=0xf8) returned 1 [0271.220] CloseHandle (hObject=0xe0) returned 1 [0271.220] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7ZRl4.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7zrl4.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7ZRl4.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7zrl4.swf.lnk.ozq0")) returned 0 [0271.221] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7ZRl4.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7zrl4.swf.lnk.ozq0")) returned 0x20 [0271.221] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7ZRl4.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e873e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e873e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ead540, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd4d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="7ZRl4.swf.lnk", cAlternateFileName="7ZRL4S~1.LNK")) returned 0x277df0 [0271.221] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e873e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e873e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ead540, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd4d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="7ZRl4.swf.lnk", cAlternateFileName="7ZRL4S~1.LNK")) returned 0 [0271.221] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0271.221] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7ZRl4.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7zrl4.swf.lnk")) returned 1 [0271.223] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\7ZRl4.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\7zrl4.swf.lnk")) returned 0xffffffff [0271.223] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61370140, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61370140, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61370140, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="9-bGVmOik4F ANkB76YN.lnk", cAlternateFileName="9-BGVM~1.LNK")) returned 1 [0271.223] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-bGVmOik4F ANkB76YN.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9-bgvmoik4f ankb76yn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0271.223] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-bGVmOik4F ANkB76YN.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9-bgvmoik4f ankb76yn.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0271.225] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa2c [0271.225] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0271.225] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0271.308] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa2c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xa2c, lpOverlapped=0x0) returned 1 [0271.314] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa30, lpOverlapped=0x0) returned 1 [0271.316] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.382] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.395] CloseHandle (hObject=0xe0) returned 1 [0271.395] CloseHandle (hObject=0xf8) returned 1 [0271.395] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-bGVmOik4F ANkB76YN.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9-bgvmoik4f ankb76yn.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-bGVmOik4F ANkB76YN.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9-bgvmoik4f ankb76yn.lnk.ozq0")) returned 0 [0271.396] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-bGVmOik4F ANkB76YN.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9-bgvmoik4f ankb76yn.lnk.ozq0")) returned 0x20 [0271.396] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-bGVmOik4F ANkB76YN.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61370140, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61370140, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61370140, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="9-bGVmOik4F ANkB76YN.lnk", cAlternateFileName="9-BGVM~1.LNK")) returned 0x277ea8 [0271.396] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61370140, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61370140, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61370140, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="9-bGVmOik4F ANkB76YN.lnk", cAlternateFileName="9-BGVM~1.LNK")) returned 0 [0271.396] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0271.396] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-bGVmOik4F ANkB76YN.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9-bgvmoik4f ankb76yn.lnk")) returned 1 [0271.397] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9-bGVmOik4F ANkB76YN.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9-bgvmoik4f ankb76yn.lnk")) returned 0xffffffff [0271.397] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6048f7c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6048f7c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6048f7c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x142d, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="9K6BRJODg 9C8gf.lnk", cAlternateFileName="9K6BRJ~1.LNK")) returned 1 [0271.398] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9K6BRJODg 9C8gf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9k6brjodg 9c8gf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0271.398] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9K6BRJODg 9C8gf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9k6brjodg 9c8gf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0271.399] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x142d [0271.399] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0271.400] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0271.458] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x142d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x142d, lpOverlapped=0x0) returned 1 [0271.459] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1430, lpOverlapped=0x0) returned 1 [0271.460] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.520] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.536] CloseHandle (hObject=0xf8) returned 1 [0271.536] CloseHandle (hObject=0xe0) returned 1 [0271.536] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9K6BRJODg 9C8gf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9k6brjodg 9c8gf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9K6BRJODg 9C8gf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9k6brjodg 9c8gf.lnk.ozq0")) returned 0 [0271.537] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9K6BRJODg 9C8gf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9k6brjodg 9c8gf.lnk.ozq0")) returned 0x20 [0271.537] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9K6BRJODg 9C8gf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6048f7c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6048f7c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6048f7c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x142d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="9K6BRJODg 9C8gf.lnk", cAlternateFileName="9K6BRJ~1.LNK")) returned 0x277e98 [0271.537] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6048f7c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6048f7c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6048f7c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x142d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="9K6BRJODg 9C8gf.lnk", cAlternateFileName="9K6BRJ~1.LNK")) returned 0 [0271.537] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0271.537] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9K6BRJODg 9C8gf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9k6brjodg 9c8gf.lnk")) returned 1 [0271.539] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9K6BRJODg 9C8gf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9k6brjodg 9c8gf.lnk")) returned 0xffffffff [0271.539] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c5d3c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c5d3c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="9uIoaheRuIWRfdg.flv.lnk", cAlternateFileName="9UIOAH~1.LNK")) returned 1 [0271.539] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uIoaheRuIWRfdg.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uioaheruiwrfdg.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0271.539] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uIoaheRuIWRfdg.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uioaheruiwrfdg.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0271.541] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe0b [0271.541] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0271.541] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0271.600] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe0b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe0b, lpOverlapped=0x0) returned 1 [0271.601] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe10, lpOverlapped=0x0) returned 1 [0271.602] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.674] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.690] CloseHandle (hObject=0xe0) returned 1 [0271.690] CloseHandle (hObject=0xf8) returned 1 [0271.690] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uIoaheRuIWRfdg.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uioaheruiwrfdg.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uIoaheRuIWRfdg.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uioaheruiwrfdg.flv.lnk.ozq0")) returned 0 [0271.691] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uIoaheRuIWRfdg.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uioaheruiwrfdg.flv.lnk.ozq0")) returned 0x20 [0271.691] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uIoaheRuIWRfdg.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c5d3c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c5d3c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="9uIoaheRuIWRfdg.flv.lnk", cAlternateFileName="9UIOAH~1.LNK")) returned 0x277ea0 [0271.691] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c5d3c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c5d3c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="9uIoaheRuIWRfdg.flv.lnk", cAlternateFileName="9UIOAH~1.LNK")) returned 0 [0271.691] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0271.691] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uIoaheRuIWRfdg.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uioaheruiwrfdg.flv.lnk")) returned 1 [0271.693] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uIoaheRuIWRfdg.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uioaheruiwrfdg.flv.lnk")) returned 0xffffffff [0271.693] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f56f40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f56f40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f56f40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="9uvxuf9.lnk", cAlternateFileName="")) returned 1 [0271.694] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uvxuf9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uvxuf9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0271.694] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uvxuf9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uvxuf9.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0271.695] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x211 [0271.695] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0271.696] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0271.744] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x211, lpOverlapped=0x0) returned 1 [0271.745] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x220, lpOverlapped=0x0) returned 1 [0271.746] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.803] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.816] CloseHandle (hObject=0xf8) returned 1 [0271.816] CloseHandle (hObject=0xe0) returned 1 [0271.817] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uvxuf9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uvxuf9.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uvxuf9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uvxuf9.lnk.ozq0")) returned 0 [0271.817] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uvxuf9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uvxuf9.lnk.ozq0")) returned 0x20 [0271.818] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uvxuf9.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f56f40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f56f40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f56f40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="9uvxuf9.lnk", cAlternateFileName="")) returned 0x277e88 [0271.818] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f56f40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f56f40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f56f40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="9uvxuf9.lnk", cAlternateFileName="")) returned 0 [0271.818] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0271.818] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uvxuf9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uvxuf9.lnk")) returned 1 [0271.819] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\9uvxuf9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\9uvxuf9.lnk")) returned 0xffffffff [0271.819] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618f1420, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618f1420, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618f1420, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="A5l3xNxrvNUA0V.lnk", cAlternateFileName="A5L3XN~1.LNK")) returned 1 [0271.820] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A5l3xNxrvNUA0V.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5l3xnxrvnua0v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0271.820] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A5l3xNxrvNUA0V.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5l3xnxrvnua0v.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0271.824] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ea [0271.824] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0271.825] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0271.875] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9ea, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9ea, lpOverlapped=0x0) returned 1 [0271.876] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9f0, lpOverlapped=0x0) returned 1 [0271.877] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0271.941] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0271.953] CloseHandle (hObject=0xe0) returned 1 [0271.953] CloseHandle (hObject=0xf8) returned 1 [0271.954] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A5l3xNxrvNUA0V.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5l3xnxrvnua0v.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A5l3xNxrvNUA0V.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5l3xnxrvnua0v.lnk.ozq0")) returned 0 [0271.955] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A5l3xNxrvNUA0V.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5l3xnxrvnua0v.lnk.ozq0")) returned 0x20 [0271.955] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A5l3xNxrvNUA0V.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618f1420, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618f1420, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618f1420, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="A5l3xNxrvNUA0V.lnk", cAlternateFileName="A5L3XN~1.LNK")) returned 0x277e98 [0271.955] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618f1420, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x618f1420, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x618f1420, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="A5l3xNxrvNUA0V.lnk", cAlternateFileName="A5L3XN~1.LNK")) returned 0 [0271.955] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0271.955] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A5l3xNxrvNUA0V.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5l3xnxrvnua0v.lnk")) returned 1 [0271.956] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\A5l3xNxrvNUA0V.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5l3xnxrvnua0v.lnk")) returned 0xffffffff [0271.956] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="a5Y9B4r.flv.lnk", cAlternateFileName="A5Y9B4~1.LNK")) returned 1 [0271.957] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5Y9B4r.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5y9b4r.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0271.957] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5Y9B4r.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5y9b4r.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0271.958] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x211 [0271.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0271.958] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0272.013] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x211, lpOverlapped=0x0) returned 1 [0272.014] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x220, lpOverlapped=0x0) returned 1 [0272.016] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.077] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.089] CloseHandle (hObject=0xf8) returned 1 [0272.089] CloseHandle (hObject=0xe0) returned 1 [0272.090] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5Y9B4r.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5y9b4r.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5Y9B4r.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5y9b4r.flv.lnk.ozq0")) returned 0 [0272.091] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5Y9B4r.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5y9b4r.flv.lnk.ozq0")) returned 0x20 [0272.091] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5Y9B4r.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="a5Y9B4r.flv.lnk", cAlternateFileName="A5Y9B4~1.LNK")) returned 0x277df0 [0272.091] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="a5Y9B4r.flv.lnk", cAlternateFileName="A5Y9B4~1.LNK")) returned 0 [0272.091] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0272.091] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5Y9B4r.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5y9b4r.flv.lnk")) returned 1 [0272.092] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\a5Y9B4r.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\a5y9b4r.flv.lnk")) returned 0xffffffff [0272.092] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606326e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x617c0920, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x617c0920, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="aJI_8nP.lnk", cAlternateFileName="")) returned 1 [0272.093] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJI_8nP.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aji_8np.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0272.093] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJI_8nP.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aji_8np.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0272.094] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8ea [0272.094] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0272.095] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0272.145] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8ea, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x8ea, lpOverlapped=0x0) returned 1 [0272.146] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x8f0, lpOverlapped=0x0) returned 1 [0272.147] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.212] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.225] CloseHandle (hObject=0xe0) returned 1 [0272.225] CloseHandle (hObject=0xf8) returned 1 [0272.225] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJI_8nP.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aji_8np.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJI_8nP.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aji_8np.lnk.ozq0")) returned 0 [0272.226] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJI_8nP.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aji_8np.lnk.ozq0")) returned 0x20 [0272.226] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJI_8nP.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606326e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x617c0920, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x617c0920, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8ea, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="aJI_8nP.lnk", cAlternateFileName="")) returned 0x277e88 [0272.226] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606326e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x617c0920, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x617c0920, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8ea, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="aJI_8nP.lnk", cAlternateFileName="")) returned 0 [0272.226] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0272.226] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJI_8nP.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aji_8np.lnk")) returned 1 [0272.227] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aJI_8nP.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aji_8np.lnk")) returned 0xffffffff [0272.227] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61134ca0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61134ca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61134ca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="aM63xM3LuAEGP v-Io.flv.lnk", cAlternateFileName="AM63XM~1.LNK")) returned 1 [0272.228] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aM63xM3LuAEGP v-Io.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\am63xm3luaegp v-io.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0272.229] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aM63xM3LuAEGP v-Io.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\am63xm3luaegp v-io.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0272.230] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e8 [0272.231] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0272.231] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0272.283] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3e8, lpOverlapped=0x0) returned 1 [0272.284] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0272.285] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.343] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.356] CloseHandle (hObject=0xf8) returned 1 [0272.356] CloseHandle (hObject=0xe0) returned 1 [0272.356] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aM63xM3LuAEGP v-Io.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\am63xm3luaegp v-io.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aM63xM3LuAEGP v-Io.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\am63xm3luaegp v-io.flv.lnk.ozq0")) returned 0 [0272.357] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aM63xM3LuAEGP v-Io.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\am63xm3luaegp v-io.flv.lnk.ozq0")) returned 0x20 [0272.357] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aM63xM3LuAEGP v-Io.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61134ca0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61134ca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61134ca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="aM63xM3LuAEGP v-Io.flv.lnk", cAlternateFileName="AM63XM~1.LNK")) returned 0x277ea8 [0272.358] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61134ca0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61134ca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61134ca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="aM63xM3LuAEGP v-Io.flv.lnk", cAlternateFileName="AM63XM~1.LNK")) returned 0 [0272.358] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0272.358] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aM63xM3LuAEGP v-Io.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\am63xm3luaegp v-io.flv.lnk")) returned 1 [0272.359] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aM63xM3LuAEGP v-Io.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\am63xm3luaegp v-io.flv.lnk")) returned 0xffffffff [0272.359] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ccf7e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ccf7e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ccf7e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1383, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="aNzh.lnk", cAlternateFileName="")) returned 1 [0272.359] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aNzh.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\anzh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0272.359] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aNzh.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\anzh.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0272.360] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1383 [0272.361] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0272.361] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0272.410] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1383, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1383, lpOverlapped=0x0) returned 1 [0272.411] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1390, lpOverlapped=0x0) returned 1 [0272.412] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.488] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.503] CloseHandle (hObject=0xe0) returned 1 [0272.503] CloseHandle (hObject=0xf8) returned 1 [0272.503] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aNzh.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\anzh.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aNzh.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\anzh.lnk.ozq0")) returned 0 [0272.504] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aNzh.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\anzh.lnk.ozq0")) returned 0x20 [0272.504] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aNzh.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ccf7e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ccf7e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ccf7e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1383, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="aNzh.lnk", cAlternateFileName="")) returned 0x277e88 [0272.504] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ccf7e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ccf7e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ccf7e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1383, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="aNzh.lnk", cAlternateFileName="")) returned 0 [0272.504] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0272.504] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aNzh.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\anzh.lnk")) returned 1 [0272.505] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\aNzh.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\anzh.lnk")) returned 0xffffffff [0272.505] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b8d860, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60b8d860, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60bb39c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1297, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="AQmXWnSFu_vaDwtr.flv.lnk", cAlternateFileName="AQMXWN~1.LNK")) returned 1 [0272.506] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQmXWnSFu_vaDwtr.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aqmxwnsfu_vadwtr.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0272.506] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQmXWnSFu_vaDwtr.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aqmxwnsfu_vadwtr.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0272.507] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1297 [0272.507] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0272.507] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0272.554] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1297, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1297, lpOverlapped=0x0) returned 1 [0272.555] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x12a0, lpOverlapped=0x0) returned 1 [0272.556] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.616] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.629] CloseHandle (hObject=0xf8) returned 1 [0272.629] CloseHandle (hObject=0xe0) returned 1 [0272.629] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQmXWnSFu_vaDwtr.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aqmxwnsfu_vadwtr.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQmXWnSFu_vaDwtr.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aqmxwnsfu_vadwtr.flv.lnk.ozq0")) returned 0 [0272.630] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQmXWnSFu_vaDwtr.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aqmxwnsfu_vadwtr.flv.lnk.ozq0")) returned 0x20 [0272.630] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQmXWnSFu_vaDwtr.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b8d860, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60b8d860, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60bb39c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1297, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="AQmXWnSFu_vaDwtr.flv.lnk", cAlternateFileName="AQMXWN~1.LNK")) returned 0x277ea8 [0272.630] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b8d860, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60b8d860, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60bb39c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1297, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="AQmXWnSFu_vaDwtr.flv.lnk", cAlternateFileName="AQMXWN~1.LNK")) returned 0 [0272.630] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0272.631] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQmXWnSFu_vaDwtr.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aqmxwnsfu_vadwtr.flv.lnk")) returned 1 [0272.632] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AQmXWnSFu_vaDwtr.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\aqmxwnsfu_vadwtr.flv.lnk")) returned 0xffffffff [0272.632] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x478c2f30, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x478c2f30, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="AutomaticDestinations", cAlternateFileName="AUTOMA~1")) returned 1 [0272.632] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x478c2f30, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x478c2f30, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x277df0, cFileName=".", cAlternateFileName="")) returned 0x277ea8 [0272.632] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x478c2f30, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x478c2f30, ftLastWriteTime.dwHighDateTime=0x1d706ac, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xaa00a8, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 1 [0272.632] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799b81f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x6155f320, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x17c00, dwReserved0=0xaa00a8, dwReserved1=0x277df0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 1 [0272.633] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0272.633] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0272.634] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x17c00 [0272.634] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0272.635] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0272.685] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x17c00, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x17c00, lpOverlapped=0x0) returned 1 [0272.687] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x17c10, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x17c10, lpOverlapped=0x0) returned 1 [0272.689] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.755] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.770] CloseHandle (hObject=0xf8) returned 1 [0272.770] CloseHandle (hObject=0xf4) returned 1 [0272.775] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.ozq0")) returned 0 [0272.776] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms.ozq0")) returned 0x20 [0272.777] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799b81f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x6155f320, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x17c00, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0x277df0 [0272.777] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799b81f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x6155f320, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x17c00, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1b4dd67f29cb1962.automaticDestinations-ms", cAlternateFileName="1B4DD6~1.AUT")) returned 0 [0272.777] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0272.777] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms")) returned 1 [0272.779] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\1b4dd67f29cb1962.automaticDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\1b4dd67f29cb1962.automaticdestinations-ms")) returned 0xffffffff [0272.779] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47876c70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x47876c70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x38c30790, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 1 [0272.780] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0272.781] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0272.782] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1400 [0272.782] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0272.783] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0272.838] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x1400, lpOverlapped=0x0) returned 1 [0272.841] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x1410, lpOverlapped=0x0) returned 1 [0272.843] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0272.901] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0272.914] CloseHandle (hObject=0xf4) returned 1 [0272.914] CloseHandle (hObject=0xf8) returned 1 [0272.915] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.ozq0")) returned 0 [0272.916] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms.ozq0")) returned 0x20 [0272.916] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47876c70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x47876c70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x38c30790, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 0x277df0 [0272.916] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47876c70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x47876c70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x38c30790, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 0 [0272.916] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0272.916] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms")) returned 1 [0272.917] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\7e4dca80246863e3.automaticDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\automaticdestinations\\7e4dca80246863e3.automaticdestinations-ms")) returned 0xffffffff [0272.917] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47876c70, ftCreationTime.dwHighDateTime=0x1d706ac, ftLastAccessTime.dwLowDateTime=0x47876c70, ftLastAccessTime.dwHighDateTime=0x1d706ac, ftLastWriteTime.dwLowDateTime=0x38c30790, ftLastWriteTime.dwHighDateTime=0x1d7b065, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="7e4dca80246863e3.automaticDestinations-ms", cAlternateFileName="7E4DCA~1.AUT")) returned 0 [0272.917] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0272.918] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d1baa0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d1baa0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x65333638, dwReserved1=0x75612e33, cFileName="avPmUVpzLwYkYVep7.lnk", cAlternateFileName="AVPMUV~1.LNK")) returned 1 [0272.918] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\avPmUVpzLwYkYVep7.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\avpmuvpzlwykyvep7.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0272.918] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\avPmUVpzLwYkYVep7.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\avpmuvpzlwykyvep7.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0272.919] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9eb [0272.920] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0272.920] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0272.972] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9eb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9eb, lpOverlapped=0x0) returned 1 [0272.973] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9f0, lpOverlapped=0x0) returned 1 [0272.974] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.033] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.048] CloseHandle (hObject=0xe0) returned 1 [0273.048] CloseHandle (hObject=0xf8) returned 1 [0273.048] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\avPmUVpzLwYkYVep7.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\avpmuvpzlwykyvep7.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\avPmUVpzLwYkYVep7.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\avpmuvpzlwykyvep7.lnk.ozq0")) returned 0 [0273.049] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\avPmUVpzLwYkYVep7.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\avpmuvpzlwykyvep7.lnk.ozq0")) returned 0x20 [0273.049] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\avPmUVpzLwYkYVep7.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d1baa0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d1baa0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="avPmUVpzLwYkYVep7.lnk", cAlternateFileName="AVPMUV~1.LNK")) returned 0x277ea0 [0273.049] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d1baa0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d1baa0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9eb, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="avPmUVpzLwYkYVep7.lnk", cAlternateFileName="AVPMUV~1.LNK")) returned 0 [0273.049] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0273.049] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\avPmUVpzLwYkYVep7.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\avpmuvpzlwykyvep7.lnk")) returned 1 [0273.050] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\avPmUVpzLwYkYVep7.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\avpmuvpzlwykyvep7.lnk")) returned 0xffffffff [0273.051] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620618e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620618e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620618e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9f5, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="b6tm3RqfpvFDXYN.lnk", cAlternateFileName="B6TM3R~1.LNK")) returned 1 [0273.051] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b6tm3RqfpvFDXYN.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\b6tm3rqfpvfdxyn.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0273.051] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b6tm3RqfpvFDXYN.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\b6tm3rqfpvfdxyn.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0273.052] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9f5 [0273.052] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0273.053] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0273.101] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9f5, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9f5, lpOverlapped=0x0) returned 1 [0273.103] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0273.104] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.169] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.183] CloseHandle (hObject=0xf8) returned 1 [0273.183] CloseHandle (hObject=0xe0) returned 1 [0273.183] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b6tm3RqfpvFDXYN.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\b6tm3rqfpvfdxyn.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b6tm3RqfpvFDXYN.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\b6tm3rqfpvfdxyn.lnk.ozq0")) returned 0 [0273.184] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b6tm3RqfpvFDXYN.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\b6tm3rqfpvfdxyn.lnk.ozq0")) returned 0x20 [0273.184] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b6tm3RqfpvFDXYN.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620618e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620618e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620618e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9f5, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="b6tm3RqfpvFDXYN.lnk", cAlternateFileName="B6TM3R~1.LNK")) returned 0x277e98 [0273.184] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620618e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620618e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620618e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9f5, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="b6tm3RqfpvFDXYN.lnk", cAlternateFileName="B6TM3R~1.LNK")) returned 0 [0273.184] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0273.185] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b6tm3RqfpvFDXYN.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\b6tm3rqfpvfdxyn.lnk")) returned 1 [0273.186] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\b6tm3RqfpvFDXYN.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\b6tm3rqfpvfdxyn.lnk")) returned 0xffffffff [0273.186] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620d3d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1373, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="BGfQMG.lnk", cAlternateFileName="")) returned 1 [0273.186] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BGfQMG.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bgfqmg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0273.187] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BGfQMG.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bgfqmg.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0273.188] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1373 [0273.188] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0273.188] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0273.236] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1373, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1373, lpOverlapped=0x0) returned 1 [0273.237] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1380, lpOverlapped=0x0) returned 1 [0273.238] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.300] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.315] CloseHandle (hObject=0xe0) returned 1 [0273.315] CloseHandle (hObject=0xf8) returned 1 [0273.315] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BGfQMG.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bgfqmg.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BGfQMG.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bgfqmg.lnk.ozq0")) returned 0 [0273.316] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BGfQMG.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bgfqmg.lnk.ozq0")) returned 0x20 [0273.316] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BGfQMG.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620d3d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1373, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="BGfQMG.lnk", cAlternateFileName="")) returned 0x277e88 [0273.317] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620d3d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1373, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="BGfQMG.lnk", cAlternateFileName="")) returned 0 [0273.317] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0273.317] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BGfQMG.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bgfqmg.lnk")) returned 1 [0273.318] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BGfQMG.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bgfqmg.lnk")) returned 0xffffffff [0273.318] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6179a7c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6179a7c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6179a7c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13b3, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="BSRiJ4n4.lnk", cAlternateFileName="")) returned 1 [0273.319] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BSRiJ4n4.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bsrij4n4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0273.319] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BSRiJ4n4.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bsrij4n4.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0273.320] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13b3 [0273.321] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0273.321] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0273.377] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13b3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x13b3, lpOverlapped=0x0) returned 1 [0273.378] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x13c0, lpOverlapped=0x0) returned 1 [0273.379] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.441] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.459] CloseHandle (hObject=0xf8) returned 1 [0273.459] CloseHandle (hObject=0xe0) returned 1 [0273.459] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BSRiJ4n4.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bsrij4n4.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BSRiJ4n4.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bsrij4n4.lnk.ozq0")) returned 0 [0273.460] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BSRiJ4n4.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bsrij4n4.lnk.ozq0")) returned 0x20 [0273.460] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BSRiJ4n4.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6179a7c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6179a7c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6179a7c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13b3, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="BSRiJ4n4.lnk", cAlternateFileName="")) returned 0x277df0 [0273.460] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6179a7c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6179a7c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6179a7c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13b3, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="BSRiJ4n4.lnk", cAlternateFileName="")) returned 0 [0273.460] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0273.460] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BSRiJ4n4.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bsrij4n4.lnk")) returned 1 [0273.462] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\BSRiJ4n4.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\bsrij4n4.lnk")) returned 0xffffffff [0273.462] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNQFJ6O.lnk", cAlternateFileName="")) returned 1 [0273.462] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CNQFJ6O.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cnqfj6o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0273.462] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CNQFJ6O.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cnqfj6o.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0273.464] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe8a [0273.464] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0273.464] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0273.558] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe8a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe8a, lpOverlapped=0x0) returned 1 [0273.559] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe90, lpOverlapped=0x0) returned 1 [0273.560] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.619] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.631] CloseHandle (hObject=0xe0) returned 1 [0273.631] CloseHandle (hObject=0xf8) returned 1 [0273.631] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CNQFJ6O.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cnqfj6o.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CNQFJ6O.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cnqfj6o.lnk.ozq0")) returned 0 [0273.633] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CNQFJ6O.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cnqfj6o.lnk.ozq0")) returned 0x20 [0273.633] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CNQFJ6O.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe8a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CNQFJ6O.lnk", cAlternateFileName="")) returned 0x277e88 [0273.633] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe8a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="CNQFJ6O.lnk", cAlternateFileName="")) returned 0 [0273.633] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0273.633] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CNQFJ6O.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cnqfj6o.lnk")) returned 1 [0273.635] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CNQFJ6O.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cnqfj6o.lnk")) returned 0xffffffff [0273.635] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61454980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61513060, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61513060, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Common Files.lnk", cAlternateFileName="COMMON~1.LNK")) returned 1 [0273.635] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0273.635] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0273.636] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2a1 [0273.637] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0273.637] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0273.687] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2a1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2a1, lpOverlapped=0x0) returned 1 [0273.688] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2b0, lpOverlapped=0x0) returned 1 [0273.689] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.746] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.758] CloseHandle (hObject=0xf8) returned 1 [0273.759] CloseHandle (hObject=0xe0) returned 1 [0273.759] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk.ozq0")) returned 0 [0273.760] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk.ozq0")) returned 0x20 [0273.760] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61454980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61513060, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61513060, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Common Files.lnk", cAlternateFileName="COMMON~1.LNK")) returned 0x277e98 [0273.760] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61454980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61513060, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61513060, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Common Files.lnk", cAlternateFileName="COMMON~1.LNK")) returned 0 [0273.760] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0273.760] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk")) returned 1 [0273.761] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Common Files.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\common files.lnk")) returned 0xffffffff [0273.761] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x947d3a20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x947d3a20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="CustomDestinations", cAlternateFileName="CUSTOM~1")) returned 1 [0273.761] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\*.*", lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x947d3a20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x947d3a20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9a0098, dwReserved1=0x277df0, cFileName=".", cAlternateFileName="")) returned 0x277ea0 [0273.762] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x795418b0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x947d3a20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x947d3a20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9a0098, dwReserved1=0x277df0, cFileName="..", cAlternateFileName="")) returned 1 [0273.762] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f1ee270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f1ee270, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x9a0098, dwReserved1=0x277df0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 1 [0273.762] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0273.763] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0273.764] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0273.764] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0273.765] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0273.811] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x18, lpOverlapped=0x0) returned 1 [0273.812] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x20, lpOverlapped=0x0) returned 1 [0273.813] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0273.880] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0273.893] CloseHandle (hObject=0xf8) returned 1 [0273.893] CloseHandle (hObject=0xf4) returned 1 [0273.893] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.ozq0")) returned 0 [0273.894] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms.ozq0")) returned 0x20 [0273.894] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f1ee270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f1ee270, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 0x277df0 [0273.894] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f1ee270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f1ee270, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="1b4dd67f29cb1962.customDestinations-ms", cAlternateFileName="1B4DD6~1.CUS")) returned 0 [0273.895] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0273.895] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms")) returned 1 [0273.896] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\1b4dd67f29cb1962.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\1b4dd67f29cb1962.customdestinations-ms")) returned 0xffffffff [0273.896] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3002940, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0x947d3a20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x947d3a20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x14a3, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 1 [0273.896] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0273.897] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0273.899] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14a3 [0273.899] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0273.899] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0273.958] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x14a3, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x14a3, lpOverlapped=0x0) returned 1 [0273.960] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x14b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x14b0, lpOverlapped=0x0) returned 1 [0273.963] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.019] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.032] CloseHandle (hObject=0xf4) returned 1 [0274.032] CloseHandle (hObject=0xf8) returned 1 [0274.032] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.ozq0")) returned 0 [0274.033] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms.ozq0")) returned 0x20 [0274.033] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3002940, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0x947d3a20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x947d3a20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x14a3, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 0x277df0 [0274.033] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3002940, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0x947d3a20, ftLastAccessTime.dwHighDateTime=0x1d7b064, ftLastWriteTime.dwLowDateTime=0x947d3a20, ftLastWriteTime.dwHighDateTime=0x1d7b064, nFileSizeHigh=0x0, nFileSizeLow=0x14a3, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="590aee7bdd69b59b.customDestinations-ms", cAlternateFileName="590AEE~1.CUS")) returned 0 [0274.033] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0274.033] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms")) returned 1 [0274.034] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\590aee7bdd69b59b.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\590aee7bdd69b59b.customdestinations-ms")) returned 0xffffffff [0274.034] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7ef9a730, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ef9a730, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 1 [0274.035] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0274.035] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0274.036] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x43a3 [0274.036] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0274.036] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0274.096] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x43a3, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x43a3, lpOverlapped=0x0) returned 1 [0274.097] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x43b0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x43b0, lpOverlapped=0x0) returned 1 [0274.098] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.159] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.172] CloseHandle (hObject=0xf8) returned 1 [0274.173] CloseHandle (hObject=0xf4) returned 1 [0274.173] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.ozq0")) returned 0 [0274.174] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms.ozq0")) returned 0x20 [0274.174] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7ef9a730, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ef9a730, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 0x277df0 [0274.174] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7ef9a730, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7ef9a730, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="5afe4de1b92fc382.customDestinations-ms", cAlternateFileName="5AFE4D~1.CUS")) returned 0 [0274.174] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0274.174] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms")) returned 1 [0274.175] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\5afe4de1b92fc382.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\5afe4de1b92fc382.customdestinations-ms")) returned 0xffffffff [0274.175] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50268510, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x50ee7890, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x50ee7890, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="6d2bac8f1edf6668.customDestinations-ms", cAlternateFileName="6D2BAC~1.CUS")) returned 1 [0274.176] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6d2bac8f1edf6668.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6d2bac8f1edf6668.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0274.189] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6d2bac8f1edf6668.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6d2bac8f1edf6668.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0274.190] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x25bc [0274.190] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0274.190] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0274.236] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x25bc, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x25bc, lpOverlapped=0x0) returned 1 [0274.251] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x25c0, lpOverlapped=0x0) returned 1 [0274.253] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.312] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.324] CloseHandle (hObject=0xf4) returned 1 [0274.324] CloseHandle (hObject=0xf8) returned 1 [0274.324] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6d2bac8f1edf6668.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6d2bac8f1edf6668.customdestinations-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6d2bac8f1edf6668.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6d2bac8f1edf6668.customdestinations-ms.ozq0")) returned 0 [0274.325] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6d2bac8f1edf6668.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6d2bac8f1edf6668.customdestinations-ms.ozq0")) returned 0x20 [0274.325] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6d2bac8f1edf6668.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50268510, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x50ee7890, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x50ee7890, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="6d2bac8f1edf6668.customDestinations-ms", cAlternateFileName="6D2BAC~1.CUS")) returned 0x277df0 [0274.325] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50268510, ftCreationTime.dwHighDateTime=0x1d70912, ftLastAccessTime.dwLowDateTime=0x50ee7890, ftLastAccessTime.dwHighDateTime=0x1d70912, ftLastWriteTime.dwLowDateTime=0x50ee7890, ftLastWriteTime.dwHighDateTime=0x1d70912, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="6d2bac8f1edf6668.customDestinations-ms", cAlternateFileName="6D2BAC~1.CUS")) returned 0 [0274.325] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0274.325] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6d2bac8f1edf6668.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6d2bac8f1edf6668.customdestinations-ms")) returned 1 [0274.326] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\6d2bac8f1edf6668.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\6d2bac8f1edf6668.customdestinations-ms")) returned 0xffffffff [0274.326] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f1ee270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f1ee270, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 1 [0274.327] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0274.327] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0274.328] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18 [0274.328] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0274.329] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0274.373] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x18, lpOverlapped=0x0) returned 1 [0274.374] WriteFile (in: hFile=0xf4, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x20, lpOverlapped=0x0) returned 1 [0274.375] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.438] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.453] CloseHandle (hObject=0xf8) returned 1 [0274.453] CloseHandle (hObject=0xf4) returned 1 [0274.453] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.ozq0")) returned 0 [0274.454] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms.ozq0")) returned 0x20 [0274.454] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f1ee270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f1ee270, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0x277df0 [0274.454] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x7f1ee270, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7f1ee270, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="7e4dca80246863e3.customDestinations-ms", cAlternateFileName="7E4DCA~1.CUS")) returned 0 [0274.454] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0274.454] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms")) returned 1 [0274.455] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\7e4dca80246863e3.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\7e4dca80246863e3.customdestinations-ms")) returned 0xffffffff [0274.455] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc738d980, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0x88c02790, ftLastAccessTime.dwHighDateTime=0x1d70913, ftLastWriteTime.dwLowDateTime=0x88c02790, ftLastWriteTime.dwHighDateTime=0x1d70913, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 1 [0274.456] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf4 [0274.508] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0274.509] GetFileSize (in: hFile=0xf4, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1f68 [0274.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0274.509] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0274.552] ReadFile (in: hFile=0xf4, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1f68, lpNumberOfBytesRead=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18e900*=0x1f68, lpOverlapped=0x0) returned 1 [0274.682] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1f70, lpNumberOfBytesWritten=0x18e900, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18e900*=0x1f70, lpOverlapped=0x0) returned 1 [0274.683] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.736] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.749] CloseHandle (hObject=0xf4) returned 1 [0274.749] CloseHandle (hObject=0xf8) returned 1 [0274.749] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.ozq0")) returned 0 [0274.750] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms.ozq0")) returned 0x20 [0274.750] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms", lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc738d980, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0x88c02790, ftLastAccessTime.dwHighDateTime=0x1d70913, ftLastWriteTime.dwLowDateTime=0x88c02790, ftLastWriteTime.dwHighDateTime=0x1d70913, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0x277df0 [0274.751] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18e7fc | out: lpFindFileData=0x18e7fc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc738d980, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0x88c02790, ftLastAccessTime.dwHighDateTime=0x1d70913, ftLastWriteTime.dwLowDateTime=0x88c02790, ftLastWriteTime.dwHighDateTime=0x1d70913, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0274.751] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0274.751] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms")) returned 1 [0274.752] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\customdestinations\\d93f411851d7c929.customdestinations-ms")) returned 0xffffffff [0274.752] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18eb88 | out: lpFindFileData=0x18eb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc738d980, ftCreationTime.dwHighDateTime=0x1d706b2, ftLastAccessTime.dwLowDateTime=0x88c02790, ftLastAccessTime.dwHighDateTime=0x1d70913, ftLastWriteTime.dwLowDateTime=0x88c02790, ftLastWriteTime.dwHighDateTime=0x1d70913, nFileSizeHigh=0x0, nFileSizeLow=0x1f68, dwReserved0=0x76f7387a, dwReserved1=0x766538ad, cFileName="d93f411851d7c929.customDestinations-ms", cAlternateFileName="D93F41~1.CUS")) returned 0 [0274.752] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0274.752] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c25de0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60c25de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60c25de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x32396337, dwReserved1=0x75632e39, cFileName="cV5guOKPM965wZLZxrQ.lnk", cAlternateFileName="CV5GUO~1.LNK")) returned 1 [0274.752] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cV5guOKPM965wZLZxrQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cv5guokpm965wzlzxrq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0274.753] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cV5guOKPM965wZLZxrQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cv5guokpm965wzlzxrq.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0274.754] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa21 [0274.754] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0274.754] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0274.803] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xa21, lpOverlapped=0x0) returned 1 [0274.804] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa30, lpOverlapped=0x0) returned 1 [0274.805] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.869] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0274.882] CloseHandle (hObject=0xe0) returned 1 [0274.882] CloseHandle (hObject=0xf8) returned 1 [0274.883] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cV5guOKPM965wZLZxrQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cv5guokpm965wzlzxrq.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cV5guOKPM965wZLZxrQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cv5guokpm965wzlzxrq.lnk.ozq0")) returned 0 [0274.883] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cV5guOKPM965wZLZxrQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cv5guokpm965wzlzxrq.lnk.ozq0")) returned 0x20 [0274.884] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cV5guOKPM965wZLZxrQ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c25de0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60c25de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60c25de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="cV5guOKPM965wZLZxrQ.lnk", cAlternateFileName="CV5GUO~1.LNK")) returned 0x277ea0 [0274.884] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60c25de0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60c25de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60c25de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="cV5guOKPM965wZLZxrQ.lnk", cAlternateFileName="CV5GUO~1.LNK")) returned 0 [0274.884] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0274.884] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cV5guOKPM965wZLZxrQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cv5guokpm965wzlzxrq.lnk")) returned 1 [0274.885] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cV5guOKPM965wZLZxrQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cv5guokpm965wzlzxrq.lnk")) returned 0xffffffff [0274.885] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621de6a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x621de6a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x621de6a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="cxAWAvPP9fzdzh466.lnk", cAlternateFileName="CXAWAV~1.LNK")) returned 1 [0274.885] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cxAWAvPP9fzdzh466.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cxawavpp9fzdzh466.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0274.886] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cxAWAvPP9fzdzh466.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cxawavpp9fzdzh466.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0274.887] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa0b [0274.887] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0274.887] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0274.927] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa0b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xa0b, lpOverlapped=0x0) returned 1 [0274.928] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa10, lpOverlapped=0x0) returned 1 [0274.929] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0274.995] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.007] CloseHandle (hObject=0xf8) returned 1 [0275.007] CloseHandle (hObject=0xe0) returned 1 [0275.008] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cxAWAvPP9fzdzh466.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cxawavpp9fzdzh466.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cxAWAvPP9fzdzh466.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cxawavpp9fzdzh466.lnk.ozq0")) returned 0 [0275.008] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cxAWAvPP9fzdzh466.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cxawavpp9fzdzh466.lnk.ozq0")) returned 0x20 [0275.008] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cxAWAvPP9fzdzh466.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621de6a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x621de6a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x621de6a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="cxAWAvPP9fzdzh466.lnk", cAlternateFileName="CXAWAV~1.LNK")) returned 0x277ea0 [0275.009] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x621de6a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x621de6a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x621de6a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa0b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="cxAWAvPP9fzdzh466.lnk", cAlternateFileName="CXAWAV~1.LNK")) returned 0 [0275.009] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0275.009] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cxAWAvPP9fzdzh466.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cxawavpp9fzdzh466.lnk")) returned 1 [0275.010] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\cxAWAvPP9fzdzh466.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\cxawavpp9fzdzh466.lnk")) returned 0xffffffff [0275.010] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6123f640, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6123f640, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6123f640, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="DbbrmCKNnRykj.lnk", cAlternateFileName="DBBRMC~1.LNK")) returned 1 [0275.010] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DbbrmCKNnRykj.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dbbrmcknnrykj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0275.010] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DbbrmCKNnRykj.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dbbrmcknnrykj.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0275.011] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9df [0275.011] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0275.012] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0275.051] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9df, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9df, lpOverlapped=0x0) returned 1 [0275.051] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9e0, lpOverlapped=0x0) returned 1 [0275.053] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.123] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.134] CloseHandle (hObject=0xe0) returned 1 [0275.134] CloseHandle (hObject=0xf8) returned 1 [0275.134] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DbbrmCKNnRykj.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dbbrmcknnrykj.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DbbrmCKNnRykj.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dbbrmcknnrykj.lnk.ozq0")) returned 0 [0275.135] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DbbrmCKNnRykj.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dbbrmcknnrykj.lnk.ozq0")) returned 0x20 [0275.135] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DbbrmCKNnRykj.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6123f640, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6123f640, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6123f640, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="DbbrmCKNnRykj.lnk", cAlternateFileName="DBBRMC~1.LNK")) returned 0x277e98 [0275.135] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6123f640, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6123f640, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6123f640, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="DbbrmCKNnRykj.lnk", cAlternateFileName="DBBRMC~1.LNK")) returned 0 [0275.135] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0275.135] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DbbrmCKNnRykj.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dbbrmcknnrykj.lnk")) returned 1 [0275.137] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DbbrmCKNnRykj.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dbbrmcknnrykj.lnk")) returned 0xffffffff [0275.137] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799b81f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e827b60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0275.137] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0275.137] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0275.138] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1b0 [0275.138] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0275.138] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0275.184] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1b0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1b0, lpOverlapped=0x0) returned 1 [0275.185] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1c0, lpOverlapped=0x0) returned 1 [0275.186] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.250] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.262] CloseHandle (hObject=0xf8) returned 1 [0275.263] CloseHandle (hObject=0xe0) returned 1 [0275.263] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.ozq0")) returned 0 [0275.264] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini.ozq0")) returned 0x20 [0275.264] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799b81f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e827b60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0x277e88 [0275.264] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x799b81f0, ftCreationTime.dwHighDateTime=0x1d70509, ftLastAccessTime.dwLowDateTime=0x799b81f0, ftLastAccessTime.dwHighDateTime=0x1d70509, ftLastWriteTime.dwLowDateTime=0x7e827b60, ftLastWriteTime.dwHighDateTime=0x1d70509, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0275.264] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0275.264] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 1 [0275.265] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\desktop.ini")) returned 0xffffffff [0275.265] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606a4b00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x606a4b00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x606a4b00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="DlBTBgX992VmvKI.swf.lnk", cAlternateFileName="DLBTBG~1.LNK")) returned 1 [0275.265] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlBTBgX992VmvKI.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dlbtbgx992vmvki.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0275.266] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlBTBgX992VmvKI.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dlbtbgx992vmvki.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0275.267] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3d4 [0275.267] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0275.267] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0275.302] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3d4, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3d4, lpOverlapped=0x0) returned 1 [0275.303] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3e0, lpOverlapped=0x0) returned 1 [0275.304] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.370] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.382] CloseHandle (hObject=0xe0) returned 1 [0275.382] CloseHandle (hObject=0xf8) returned 1 [0275.382] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlBTBgX992VmvKI.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dlbtbgx992vmvki.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlBTBgX992VmvKI.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dlbtbgx992vmvki.swf.lnk.ozq0")) returned 0 [0275.383] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlBTBgX992VmvKI.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dlbtbgx992vmvki.swf.lnk.ozq0")) returned 0x20 [0275.383] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlBTBgX992VmvKI.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606a4b00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x606a4b00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x606a4b00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="DlBTBgX992VmvKI.swf.lnk", cAlternateFileName="DLBTBG~1.LNK")) returned 0x277ea0 [0275.383] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606a4b00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x606a4b00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x606a4b00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="DlBTBgX992VmvKI.swf.lnk", cAlternateFileName="DLBTBG~1.LNK")) returned 0 [0275.384] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0275.384] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlBTBgX992VmvKI.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dlbtbgx992vmvki.swf.lnk")) returned 1 [0275.385] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DlBTBgX992VmvKI.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dlbtbgx992vmvki.swf.lnk")) returned 0xffffffff [0275.385] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a5cd60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60a5cd60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60a5cd60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1876, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="DNKFPWp.ots.lnk", cAlternateFileName="DNKFPW~1.LNK")) returned 1 [0275.385] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DNKFPWp.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dnkfpwp.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0275.385] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DNKFPWp.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dnkfpwp.ots.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0275.386] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1876 [0275.386] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0275.387] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0275.425] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1876, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1876, lpOverlapped=0x0) returned 1 [0275.427] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1880, lpOverlapped=0x0) returned 1 [0275.428] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.492] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.505] CloseHandle (hObject=0xf8) returned 1 [0275.505] CloseHandle (hObject=0xe0) returned 1 [0275.505] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DNKFPWp.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dnkfpwp.ots.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DNKFPWp.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dnkfpwp.ots.lnk.ozq0")) returned 0 [0275.506] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DNKFPWp.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dnkfpwp.ots.lnk.ozq0")) returned 0x20 [0275.506] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DNKFPWp.ots.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a5cd60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60a5cd60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60a5cd60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1876, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="DNKFPWp.ots.lnk", cAlternateFileName="DNKFPW~1.LNK")) returned 0x277df0 [0275.506] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60a5cd60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60a5cd60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60a5cd60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1876, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="DNKFPWp.ots.lnk", cAlternateFileName="DNKFPW~1.LNK")) returned 0 [0275.506] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0275.506] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DNKFPWp.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dnkfpwp.ots.lnk")) returned 1 [0275.507] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\DNKFPWp.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\dnkfpwp.ots.lnk")) returned 0xffffffff [0275.507] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e2c9fa0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622c2ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622c2ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="EBAhyiRwUZrNVcfiJqY.lnk", cAlternateFileName="EBAHYI~1.LNK")) returned 1 [0275.507] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EBAhyiRwUZrNVcfiJqY.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ebahyirwuzrnvcfijqy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0275.508] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EBAhyiRwUZrNVcfiJqY.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ebahyirwuzrnvcfijqy.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0275.509] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x201 [0275.509] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0275.509] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0275.555] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x201, lpOverlapped=0x0) returned 1 [0275.556] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x210, lpOverlapped=0x0) returned 1 [0275.557] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.614] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.628] CloseHandle (hObject=0xe0) returned 1 [0275.628] CloseHandle (hObject=0xf8) returned 1 [0275.628] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EBAhyiRwUZrNVcfiJqY.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ebahyirwuzrnvcfijqy.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EBAhyiRwUZrNVcfiJqY.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ebahyirwuzrnvcfijqy.lnk.ozq0")) returned 0 [0275.629] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EBAhyiRwUZrNVcfiJqY.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ebahyirwuzrnvcfijqy.lnk.ozq0")) returned 0x20 [0275.630] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EBAhyiRwUZrNVcfiJqY.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e2c9fa0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622c2ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622c2ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="EBAhyiRwUZrNVcfiJqY.lnk", cAlternateFileName="EBAHYI~1.LNK")) returned 0x277ea0 [0275.630] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e2c9fa0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622c2ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622c2ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="EBAhyiRwUZrNVcfiJqY.lnk", cAlternateFileName="EBAHYI~1.LNK")) returned 0 [0275.630] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0275.630] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EBAhyiRwUZrNVcfiJqY.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ebahyirwuzrnvcfijqy.lnk")) returned 1 [0275.631] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\EBAhyiRwUZrNVcfiJqY.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ebahyirwuzrnvcfijqy.lnk")) returned 0xffffffff [0275.631] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612657a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612657a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612657a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="eDV9x.mkv.lnk", cAlternateFileName="EDV9XM~1.LNK")) returned 1 [0275.632] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eDV9x.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\edv9x.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0275.632] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eDV9x.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\edv9x.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0275.633] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x397 [0275.633] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0275.633] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0275.677] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x397, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x397, lpOverlapped=0x0) returned 1 [0275.678] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3a0, lpOverlapped=0x0) returned 1 [0275.679] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.741] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.755] CloseHandle (hObject=0xf8) returned 1 [0275.755] CloseHandle (hObject=0xe0) returned 1 [0275.756] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eDV9x.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\edv9x.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eDV9x.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\edv9x.mkv.lnk.ozq0")) returned 0 [0275.757] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eDV9x.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\edv9x.mkv.lnk.ozq0")) returned 0x20 [0275.757] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eDV9x.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612657a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612657a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612657a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="eDV9x.mkv.lnk", cAlternateFileName="EDV9XM~1.LNK")) returned 0x277df0 [0275.757] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612657a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612657a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612657a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x397, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="eDV9x.mkv.lnk", cAlternateFileName="EDV9XM~1.LNK")) returned 0 [0275.757] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0275.757] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eDV9x.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\edv9x.mkv.lnk")) returned 1 [0275.758] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\eDV9x.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\edv9x.mkv.lnk")) returned 0xffffffff [0275.758] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60312a00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60312a00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60312a00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ePqRUd3e.lnk", cAlternateFileName="")) returned 1 [0275.759] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ePqRUd3e.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\epqrud3e.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0275.759] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ePqRUd3e.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\epqrud3e.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0275.760] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13d9 [0275.760] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0275.761] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0275.805] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13d9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x13d9, lpOverlapped=0x0) returned 1 [0275.806] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x13e0, lpOverlapped=0x0) returned 1 [0275.807] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.870] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0275.887] CloseHandle (hObject=0xe0) returned 1 [0275.887] CloseHandle (hObject=0xf8) returned 1 [0275.887] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ePqRUd3e.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\epqrud3e.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ePqRUd3e.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\epqrud3e.lnk.ozq0")) returned 0 [0275.888] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ePqRUd3e.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\epqrud3e.lnk.ozq0")) returned 0x20 [0275.888] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ePqRUd3e.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60312a00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60312a00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60312a00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13d9, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ePqRUd3e.lnk", cAlternateFileName="")) returned 0x277df0 [0275.888] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60312a00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60312a00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60312a00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13d9, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ePqRUd3e.lnk", cAlternateFileName="")) returned 0 [0275.888] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0275.889] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ePqRUd3e.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\epqrud3e.lnk")) returned 1 [0275.890] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ePqRUd3e.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\epqrud3e.lnk")) returned 0xffffffff [0275.890] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x622c2ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622c2ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622c2ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="f7xMlT.ots.lnk", cAlternateFileName="F7XMLT~1.LNK")) returned 1 [0275.891] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f7xMlT.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\f7xmlt.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0275.891] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f7xMlT.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\f7xmlt.ots.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0275.892] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2dc [0275.892] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0275.892] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0275.930] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2dc, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2dc, lpOverlapped=0x0) returned 1 [0275.931] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2e0, lpOverlapped=0x0) returned 1 [0275.932] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0275.991] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.004] CloseHandle (hObject=0xf8) returned 1 [0276.004] CloseHandle (hObject=0xe0) returned 1 [0276.004] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f7xMlT.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\f7xmlt.ots.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f7xMlT.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\f7xmlt.ots.lnk.ozq0")) returned 0 [0276.005] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f7xMlT.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\f7xmlt.ots.lnk.ozq0")) returned 0x20 [0276.005] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f7xMlT.ots.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x622c2ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622c2ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622c2ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="f7xMlT.ots.lnk", cAlternateFileName="F7XMLT~1.LNK")) returned 0x277df0 [0276.005] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x622c2ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622c2ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622c2ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="f7xMlT.ots.lnk", cAlternateFileName="F7XMLT~1.LNK")) returned 0 [0276.005] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0276.005] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f7xMlT.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\f7xmlt.ots.lnk")) returned 1 [0276.006] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\f7xMlT.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\f7xmlt.ots.lnk")) returned 0xffffffff [0276.006] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b9ece0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b9ece0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b9ece0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="FahWdm46t.flv.lnk", cAlternateFileName="FAHWDM~1.LNK")) returned 1 [0276.007] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FahWdm46t.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fahwdm46t.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0276.007] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FahWdm46t.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fahwdm46t.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0276.008] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3b6 [0276.008] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0276.008] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0276.049] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3b6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3b6, lpOverlapped=0x0) returned 1 [0276.050] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3c0, lpOverlapped=0x0) returned 1 [0276.052] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.121] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.133] CloseHandle (hObject=0xe0) returned 1 [0276.133] CloseHandle (hObject=0xf8) returned 1 [0276.133] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FahWdm46t.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fahwdm46t.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FahWdm46t.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fahwdm46t.flv.lnk.ozq0")) returned 0 [0276.134] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FahWdm46t.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fahwdm46t.flv.lnk.ozq0")) returned 0x20 [0276.134] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FahWdm46t.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b9ece0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b9ece0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b9ece0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FahWdm46t.flv.lnk", cAlternateFileName="FAHWDM~1.LNK")) returned 0x277e98 [0276.134] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b9ece0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b9ece0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b9ece0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FahWdm46t.flv.lnk", cAlternateFileName="FAHWDM~1.LNK")) returned 0 [0276.134] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0276.134] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FahWdm46t.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fahwdm46t.flv.lnk")) returned 1 [0276.135] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FahWdm46t.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fahwdm46t.flv.lnk")) returned 0xffffffff [0276.135] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x624fe380, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624fe380, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624fe380, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1428, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fJMDxOH6RKQj2MP5ki_.lnk", cAlternateFileName="FJMDXO~1.LNK")) returned 1 [0276.135] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJMDxOH6RKQj2MP5ki_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fjmdxoh6rkqj2mp5ki_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0276.136] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJMDxOH6RKQj2MP5ki_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fjmdxoh6rkqj2mp5ki_.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0276.137] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1428 [0276.137] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0276.137] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0276.193] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1428, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1428, lpOverlapped=0x0) returned 1 [0276.195] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1430, lpOverlapped=0x0) returned 1 [0276.197] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.276] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.288] CloseHandle (hObject=0xf8) returned 1 [0276.288] CloseHandle (hObject=0xe0) returned 1 [0276.288] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJMDxOH6RKQj2MP5ki_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fjmdxoh6rkqj2mp5ki_.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJMDxOH6RKQj2MP5ki_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fjmdxoh6rkqj2mp5ki_.lnk.ozq0")) returned 0 [0276.290] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJMDxOH6RKQj2MP5ki_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fjmdxoh6rkqj2mp5ki_.lnk.ozq0")) returned 0x20 [0276.290] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJMDxOH6RKQj2MP5ki_.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x624fe380, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624fe380, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624fe380, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1428, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="fJMDxOH6RKQj2MP5ki_.lnk", cAlternateFileName="FJMDXO~1.LNK")) returned 0x277ea0 [0276.290] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x624fe380, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624fe380, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624fe380, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1428, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="fJMDxOH6RKQj2MP5ki_.lnk", cAlternateFileName="FJMDXO~1.LNK")) returned 0 [0276.290] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0276.290] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJMDxOH6RKQj2MP5ki_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fjmdxoh6rkqj2mp5ki_.lnk")) returned 1 [0276.292] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fJMDxOH6RKQj2MP5ki_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fjmdxoh6rkqj2mp5ki_.lnk")) returned 0xffffffff [0276.292] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f91d80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f91d80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f91d80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="FlcJAUyAJDR-3Onqp.lnk", cAlternateFileName="FLCJAU~1.LNK")) returned 1 [0276.293] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FlcJAUyAJDR-3Onqp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\flcjauyajdr-3onqp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0276.293] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FlcJAUyAJDR-3Onqp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\flcjauyajdr-3onqp.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0276.294] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1412 [0276.294] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0276.295] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0276.348] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1412, lpOverlapped=0x0) returned 1 [0276.349] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1420, lpOverlapped=0x0) returned 1 [0276.350] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.419] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.436] CloseHandle (hObject=0xe0) returned 1 [0276.436] CloseHandle (hObject=0xf8) returned 1 [0276.440] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FlcJAUyAJDR-3Onqp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\flcjauyajdr-3onqp.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FlcJAUyAJDR-3Onqp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\flcjauyajdr-3onqp.lnk.ozq0")) returned 0 [0276.442] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FlcJAUyAJDR-3Onqp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\flcjauyajdr-3onqp.lnk.ozq0")) returned 0x20 [0276.442] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FlcJAUyAJDR-3Onqp.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f91d80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f91d80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f91d80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FlcJAUyAJDR-3Onqp.lnk", cAlternateFileName="FLCJAU~1.LNK")) returned 0x277ea0 [0276.443] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f91d80, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f91d80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f91d80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="FlcJAUyAJDR-3Onqp.lnk", cAlternateFileName="FLCJAU~1.LNK")) returned 0 [0276.443] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0276.443] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FlcJAUyAJDR-3Onqp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\flcjauyajdr-3onqp.lnk")) returned 1 [0276.444] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\FlcJAUyAJDR-3Onqp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\flcjauyajdr-3onqp.lnk")) returned 0xffffffff [0276.444] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cf5940, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61cf5940, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="fXJcGCuP j33 lPXfYD.lnk", cAlternateFileName="FXJCGC~1.LNK")) returned 1 [0276.445] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXJcGCuP j33 lPXfYD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fxjcgcup j33 lpxfyd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0276.445] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXJcGCuP j33 lPXfYD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fxjcgcup j33 lpxfyd.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0276.446] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa21 [0276.447] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0276.447] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0276.516] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa21, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xa21, lpOverlapped=0x0) returned 1 [0276.517] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa30, lpOverlapped=0x0) returned 1 [0276.519] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.624] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.639] CloseHandle (hObject=0xf8) returned 1 [0276.639] CloseHandle (hObject=0xe0) returned 1 [0276.640] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXJcGCuP j33 lPXfYD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fxjcgcup j33 lpxfyd.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXJcGCuP j33 lPXfYD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fxjcgcup j33 lpxfyd.lnk.ozq0")) returned 0 [0276.640] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXJcGCuP j33 lPXfYD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fxjcgcup j33 lpxfyd.lnk.ozq0")) returned 0x20 [0276.641] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXJcGCuP j33 lPXfYD.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cf5940, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61cf5940, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="fXJcGCuP j33 lPXfYD.lnk", cAlternateFileName="FXJCGC~1.LNK")) returned 0x277ea0 [0276.641] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cf5940, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61cf5940, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="fXJcGCuP j33 lPXfYD.lnk", cAlternateFileName="FXJCGC~1.LNK")) returned 0 [0276.641] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0276.641] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXJcGCuP j33 lPXfYD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fxjcgcup j33 lpxfyd.lnk")) returned 1 [0276.642] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\fXJcGCuP j33 lPXfYD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\fxjcgcup j33 lpxfyd.lnk")) returned 0xffffffff [0276.642] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612fdd20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612fdd20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612fdd20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="G2Y3bwebNDJ9bDD7G.lnk", cAlternateFileName="G2Y3BW~1.LNK")) returned 1 [0276.643] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G2Y3bwebNDJ9bDD7G.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\g2y3bwebndj9bdd7g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0276.643] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G2Y3bwebNDJ9bDD7G.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\g2y3bwebndj9bdd7g.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0276.644] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e3 [0276.644] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0276.645] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0276.695] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3e3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3e3, lpOverlapped=0x0) returned 1 [0276.696] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0276.697] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.760] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.775] CloseHandle (hObject=0xe0) returned 1 [0276.775] CloseHandle (hObject=0xf8) returned 1 [0276.776] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G2Y3bwebNDJ9bDD7G.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\g2y3bwebndj9bdd7g.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G2Y3bwebNDJ9bDD7G.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\g2y3bwebndj9bdd7g.lnk.ozq0")) returned 0 [0276.777] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G2Y3bwebNDJ9bDD7G.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\g2y3bwebndj9bdd7g.lnk.ozq0")) returned 0x20 [0276.777] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G2Y3bwebNDJ9bDD7G.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612fdd20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612fdd20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612fdd20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="G2Y3bwebNDJ9bDD7G.lnk", cAlternateFileName="G2Y3BW~1.LNK")) returned 0x277ea0 [0276.777] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612fdd20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612fdd20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612fdd20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e3, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="G2Y3bwebNDJ9bDD7G.lnk", cAlternateFileName="G2Y3BW~1.LNK")) returned 0 [0276.777] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0276.777] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G2Y3bwebNDJ9bDD7G.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\g2y3bwebndj9bdd7g.lnk")) returned 1 [0276.778] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\G2Y3bwebNDJ9bDD7G.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\g2y3bwebndj9bdd7g.lnk")) returned 0xffffffff [0276.778] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620d3d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="gEPEJ5Hc.lnk", cAlternateFileName="")) returned 1 [0276.779] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gEPEJ5Hc.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gepej5hc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0276.779] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gEPEJ5Hc.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gepej5hc.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0276.780] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x218 [0276.780] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0276.780] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0276.828] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x218, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x218, lpOverlapped=0x0) returned 1 [0276.829] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x220, lpOverlapped=0x0) returned 1 [0276.831] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0276.893] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0276.910] CloseHandle (hObject=0xf8) returned 1 [0276.910] CloseHandle (hObject=0xe0) returned 1 [0276.910] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gEPEJ5Hc.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gepej5hc.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gEPEJ5Hc.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gepej5hc.lnk.ozq0")) returned 0 [0276.911] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gEPEJ5Hc.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gepej5hc.lnk.ozq0")) returned 0x20 [0276.911] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gEPEJ5Hc.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620d3d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="gEPEJ5Hc.lnk", cAlternateFileName="")) returned 0x277df0 [0276.911] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620d3d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x218, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="gEPEJ5Hc.lnk", cAlternateFileName="")) returned 0 [0276.911] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0276.911] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gEPEJ5Hc.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gepej5hc.lnk")) returned 1 [0276.913] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gEPEJ5Hc.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gepej5hc.lnk")) returned 0xffffffff [0276.913] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61917580, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61917580, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61917580, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="gX6Wjm-hDVexWq.lnk", cAlternateFileName="GX6WJM~1.LNK")) returned 1 [0276.913] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gX6Wjm-hDVexWq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gx6wjm-hdvexwq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0276.913] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gX6Wjm-hDVexWq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gx6wjm-hdvexwq.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0276.915] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3cf [0276.915] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0276.915] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0276.958] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3cf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3cf, lpOverlapped=0x0) returned 1 [0276.959] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3d0, lpOverlapped=0x0) returned 1 [0276.960] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.019] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.032] CloseHandle (hObject=0xe0) returned 1 [0277.032] CloseHandle (hObject=0xf8) returned 1 [0277.032] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gX6Wjm-hDVexWq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gx6wjm-hdvexwq.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gX6Wjm-hDVexWq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gx6wjm-hdvexwq.lnk.ozq0")) returned 0 [0277.034] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gX6Wjm-hDVexWq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gx6wjm-hdvexwq.lnk.ozq0")) returned 0x20 [0277.034] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gX6Wjm-hDVexWq.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61917580, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61917580, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61917580, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="gX6Wjm-hDVexWq.lnk", cAlternateFileName="GX6WJM~1.LNK")) returned 0x277e98 [0277.034] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61917580, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61917580, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61917580, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3cf, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="gX6Wjm-hDVexWq.lnk", cAlternateFileName="GX6WJM~1.LNK")) returned 0 [0277.034] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0277.034] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gX6Wjm-hDVexWq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gx6wjm-hdvexwq.lnk")) returned 1 [0277.035] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\gX6Wjm-hDVexWq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\gx6wjm-hdvexwq.lnk")) returned 0xffffffff [0277.035] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6110eb40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6110eb40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6110eb40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="H4mj15AZIMtVUlsry W.swf.lnk", cAlternateFileName="H4MJ15~1.LNK")) returned 1 [0277.036] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H4mj15AZIMtVUlsry W.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\h4mj15azimtvulsry w.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0277.036] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H4mj15AZIMtVUlsry W.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\h4mj15azimtvulsry w.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0277.037] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x24f [0277.037] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0277.038] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0277.083] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x24f, lpOverlapped=0x0) returned 1 [0277.084] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x250, lpOverlapped=0x0) returned 1 [0277.086] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.148] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.180] CloseHandle (hObject=0xf8) returned 1 [0277.180] CloseHandle (hObject=0xe0) returned 1 [0277.181] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H4mj15AZIMtVUlsry W.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\h4mj15azimtvulsry w.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H4mj15AZIMtVUlsry W.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\h4mj15azimtvulsry w.swf.lnk.ozq0")) returned 0 [0277.182] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H4mj15AZIMtVUlsry W.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\h4mj15azimtvulsry w.swf.lnk.ozq0")) returned 0x20 [0277.182] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H4mj15AZIMtVUlsry W.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6110eb40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6110eb40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6110eb40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="H4mj15AZIMtVUlsry W.swf.lnk", cAlternateFileName="H4MJ15~1.LNK")) returned 0x277ea8 [0277.182] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6110eb40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6110eb40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6110eb40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="H4mj15AZIMtVUlsry W.swf.lnk", cAlternateFileName="H4MJ15~1.LNK")) returned 0 [0277.182] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0277.182] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H4mj15AZIMtVUlsry W.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\h4mj15azimtvulsry w.swf.lnk")) returned 1 [0277.184] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\H4mj15AZIMtVUlsry W.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\h4mj15azimtvulsry w.swf.lnk")) returned 0xffffffff [0277.184] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620adba0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620adba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620adba0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xedb, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="hhVjrOxjhH4oXf.lnk", cAlternateFileName="HHVJRO~1.LNK")) returned 1 [0277.184] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hhVjrOxjhH4oXf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hhvjroxjhh4oxf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0277.185] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hhVjrOxjhH4oXf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hhvjroxjhh4oxf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0277.186] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xedb [0277.186] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0277.186] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0277.236] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xedb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xedb, lpOverlapped=0x0) returned 1 [0277.237] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xee0, lpOverlapped=0x0) returned 1 [0277.238] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.301] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.313] CloseHandle (hObject=0xe0) returned 1 [0277.313] CloseHandle (hObject=0xf8) returned 1 [0277.313] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hhVjrOxjhH4oXf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hhvjroxjhh4oxf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hhVjrOxjhH4oXf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hhvjroxjhh4oxf.lnk.ozq0")) returned 0 [0277.314] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hhVjrOxjhH4oXf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hhvjroxjhh4oxf.lnk.ozq0")) returned 0x20 [0277.314] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hhVjrOxjhH4oXf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620adba0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620adba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620adba0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xedb, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="hhVjrOxjhH4oXf.lnk", cAlternateFileName="HHVJRO~1.LNK")) returned 0x277e98 [0277.314] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620adba0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620adba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620adba0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xedb, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="hhVjrOxjhH4oXf.lnk", cAlternateFileName="HHVJRO~1.LNK")) returned 0 [0277.315] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0277.315] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hhVjrOxjhH4oXf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hhvjroxjhh4oxf.lnk")) returned 1 [0277.316] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\hhVjrOxjhH4oXf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hhvjroxjhh4oxf.lnk")) returned 0xffffffff [0277.316] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f02db60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625244e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625244e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="HmB7k.lnk", cAlternateFileName="")) returned 1 [0277.316] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HmB7k.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hmb7k.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0277.316] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HmB7k.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hmb7k.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0277.317] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe19 [0277.317] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0277.318] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0277.379] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe19, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe19, lpOverlapped=0x0) returned 1 [0277.380] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe20, lpOverlapped=0x0) returned 1 [0277.381] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.448] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.461] CloseHandle (hObject=0xf8) returned 1 [0277.461] CloseHandle (hObject=0xe0) returned 1 [0277.461] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HmB7k.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hmb7k.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HmB7k.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hmb7k.lnk.ozq0")) returned 0 [0277.462] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HmB7k.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hmb7k.lnk.ozq0")) returned 0x20 [0277.462] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HmB7k.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f02db60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625244e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625244e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="HmB7k.lnk", cAlternateFileName="")) returned 0x277e88 [0277.462] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f02db60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625244e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625244e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="HmB7k.lnk", cAlternateFileName="")) returned 0 [0277.462] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0277.462] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HmB7k.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hmb7k.lnk")) returned 1 [0277.463] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HmB7k.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\hmb7k.lnk")) returned 0xffffffff [0277.463] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fde040, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fde040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fde040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x146a, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="HtmgYD47WJ3ZH.lnk", cAlternateFileName="HTMGYD~1.LNK")) returned 1 [0277.464] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtmgYD47WJ3ZH.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\htmgyd47wj3zh.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0277.464] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtmgYD47WJ3ZH.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\htmgyd47wj3zh.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0277.468] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x146a [0277.468] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0277.468] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0277.534] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x146a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x146a, lpOverlapped=0x0) returned 1 [0277.535] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1470, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1470, lpOverlapped=0x0) returned 1 [0277.536] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.606] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.618] CloseHandle (hObject=0xe0) returned 1 [0277.618] CloseHandle (hObject=0xf8) returned 1 [0277.618] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtmgYD47WJ3ZH.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\htmgyd47wj3zh.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtmgYD47WJ3ZH.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\htmgyd47wj3zh.lnk.ozq0")) returned 0 [0277.619] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtmgYD47WJ3ZH.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\htmgyd47wj3zh.lnk.ozq0")) returned 0x20 [0277.619] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtmgYD47WJ3ZH.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fde040, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fde040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fde040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x146a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="HtmgYD47WJ3ZH.lnk", cAlternateFileName="HTMGYD~1.LNK")) returned 0x277e98 [0277.619] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fde040, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fde040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fde040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x146a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="HtmgYD47WJ3ZH.lnk", cAlternateFileName="HTMGYD~1.LNK")) returned 0 [0277.619] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0277.619] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtmgYD47WJ3ZH.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\htmgyd47wj3zh.lnk")) returned 1 [0277.620] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\HtmgYD47WJ3ZH.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\htmgyd47wj3zh.lnk")) returned 0xffffffff [0277.621] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x622e9040, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622e9040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622e9040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x145d, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="i-hzwmZPjRN1A9bSdSNq.lnk", cAlternateFileName="I-HZWM~1.LNK")) returned 1 [0277.621] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i-hzwmZPjRN1A9bSdSNq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i-hzwmzpjrn1a9bsdsnq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0277.621] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i-hzwmZPjRN1A9bSdSNq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i-hzwmzpjrn1a9bsdsnq.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0277.623] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145d [0277.623] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0277.623] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0277.670] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x145d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x145d, lpOverlapped=0x0) returned 1 [0277.671] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1460, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1460, lpOverlapped=0x0) returned 1 [0277.672] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.736] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.747] CloseHandle (hObject=0xf8) returned 1 [0277.747] CloseHandle (hObject=0xe0) returned 1 [0277.747] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i-hzwmZPjRN1A9bSdSNq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i-hzwmzpjrn1a9bsdsnq.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i-hzwmZPjRN1A9bSdSNq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i-hzwmzpjrn1a9bsdsnq.lnk.ozq0")) returned 0 [0277.748] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i-hzwmZPjRN1A9bSdSNq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i-hzwmzpjrn1a9bsdsnq.lnk.ozq0")) returned 0x20 [0277.748] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i-hzwmZPjRN1A9bSdSNq.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x622e9040, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622e9040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622e9040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x145d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="i-hzwmZPjRN1A9bSdSNq.lnk", cAlternateFileName="I-HZWM~1.LNK")) returned 0x277ea8 [0277.748] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x622e9040, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622e9040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622e9040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x145d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="i-hzwmZPjRN1A9bSdSNq.lnk", cAlternateFileName="I-HZWM~1.LNK")) returned 0 [0277.748] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0277.748] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i-hzwmZPjRN1A9bSdSNq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i-hzwmzpjrn1a9bsdsnq.lnk")) returned 1 [0277.750] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\i-hzwmZPjRN1A9bSdSNq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i-hzwmzpjrn1a9bsdsnq.lnk")) returned 0xffffffff [0277.750] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a21f20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a21f20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a21f20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1297, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="I1wvhOPmSYoxfXOe.swf.lnk", cAlternateFileName="I1WVHO~1.LNK")) returned 1 [0277.750] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1wvhOPmSYoxfXOe.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i1wvhopmsyoxfxoe.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0277.750] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1wvhOPmSYoxfXOe.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i1wvhopmsyoxfxoe.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0277.752] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1297 [0277.752] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0277.752] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0277.798] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1297, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1297, lpOverlapped=0x0) returned 1 [0277.799] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x12a0, lpOverlapped=0x0) returned 1 [0277.800] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.859] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.870] CloseHandle (hObject=0xe0) returned 1 [0277.870] CloseHandle (hObject=0xf8) returned 1 [0277.870] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1wvhOPmSYoxfXOe.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i1wvhopmsyoxfxoe.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1wvhOPmSYoxfXOe.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i1wvhopmsyoxfxoe.swf.lnk.ozq0")) returned 0 [0277.871] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1wvhOPmSYoxfXOe.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i1wvhopmsyoxfxoe.swf.lnk.ozq0")) returned 0x20 [0277.871] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1wvhOPmSYoxfXOe.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a21f20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a21f20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a21f20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1297, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="I1wvhOPmSYoxfXOe.swf.lnk", cAlternateFileName="I1WVHO~1.LNK")) returned 0x277ea8 [0277.871] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a21f20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a21f20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a21f20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1297, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="I1wvhOPmSYoxfXOe.swf.lnk", cAlternateFileName="I1WVHO~1.LNK")) returned 0 [0277.871] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0277.871] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1wvhOPmSYoxfXOe.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i1wvhopmsyoxfxoe.swf.lnk")) returned 1 [0277.872] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\I1wvhOPmSYoxfXOe.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\i1wvhopmsyoxfxoe.swf.lnk")) returned 0xffffffff [0277.873] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9bf, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="iBlpN MB9f.pdf.lnk", cAlternateFileName="IBLPNM~1.LNK")) returned 1 [0277.873] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBlpN MB9f.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iblpn mb9f.pdf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0277.873] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBlpN MB9f.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iblpn mb9f.pdf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0277.874] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9bf [0277.874] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0277.875] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0277.921] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9bf, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9bf, lpOverlapped=0x0) returned 1 [0277.922] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9c0, lpOverlapped=0x0) returned 1 [0277.923] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0277.986] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0277.998] CloseHandle (hObject=0xf8) returned 1 [0277.998] CloseHandle (hObject=0xe0) returned 1 [0277.998] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBlpN MB9f.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iblpn mb9f.pdf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBlpN MB9f.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iblpn mb9f.pdf.lnk.ozq0")) returned 0 [0277.999] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBlpN MB9f.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iblpn mb9f.pdf.lnk.ozq0")) returned 0x20 [0277.999] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBlpN MB9f.pdf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9bf, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="iBlpN MB9f.pdf.lnk", cAlternateFileName="IBLPNM~1.LNK")) returned 0x277e98 [0277.999] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60ef9800, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60ef9800, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60ef9800, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9bf, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="iBlpN MB9f.pdf.lnk", cAlternateFileName="IBLPNM~1.LNK")) returned 0 [0277.999] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0277.999] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBlpN MB9f.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iblpn mb9f.pdf.lnk")) returned 1 [0278.000] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iBlpN MB9f.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iblpn mb9f.pdf.lnk")) returned 0xffffffff [0278.000] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x624b20c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624b20c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624b20c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1448, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="iCSHzDA11rOdGUQ.lnk", cAlternateFileName="ICSHZD~1.LNK")) returned 1 [0278.001] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iCSHzDA11rOdGUQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\icshzda11rodguq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0278.001] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iCSHzDA11rOdGUQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\icshzda11rodguq.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0278.002] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1448 [0278.002] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0278.002] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0278.058] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1448, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1448, lpOverlapped=0x0) returned 1 [0278.059] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1450, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1450, lpOverlapped=0x0) returned 1 [0278.060] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.126] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.139] CloseHandle (hObject=0xe0) returned 1 [0278.139] CloseHandle (hObject=0xf8) returned 1 [0278.139] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iCSHzDA11rOdGUQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\icshzda11rodguq.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iCSHzDA11rOdGUQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\icshzda11rodguq.lnk.ozq0")) returned 0 [0278.140] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iCSHzDA11rOdGUQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\icshzda11rodguq.lnk.ozq0")) returned 0x20 [0278.140] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iCSHzDA11rOdGUQ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x624b20c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624b20c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624b20c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1448, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="iCSHzDA11rOdGUQ.lnk", cAlternateFileName="ICSHZD~1.LNK")) returned 0x277e98 [0278.140] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x624b20c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x624b20c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x624b20c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1448, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="iCSHzDA11rOdGUQ.lnk", cAlternateFileName="ICSHZD~1.LNK")) returned 0 [0278.140] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0278.140] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iCSHzDA11rOdGUQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\icshzda11rodguq.lnk")) returned 1 [0278.142] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iCSHzDA11rOdGUQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\icshzda11rodguq.lnk")) returned 0xffffffff [0278.142] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dc8d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6243fca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6243fca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8cd, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="IppW.lnk", cAlternateFileName="")) returned 1 [0278.142] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IppW.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ippw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0278.143] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IppW.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ippw.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0278.144] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8cd [0278.144] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0278.144] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0278.191] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8cd, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x8cd, lpOverlapped=0x0) returned 1 [0278.192] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x8d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x8d0, lpOverlapped=0x0) returned 1 [0278.193] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.245] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.257] CloseHandle (hObject=0xf8) returned 1 [0278.257] CloseHandle (hObject=0xe0) returned 1 [0278.257] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IppW.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ippw.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IppW.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ippw.lnk.ozq0")) returned 0 [0278.258] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IppW.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ippw.lnk.ozq0")) returned 0x20 [0278.258] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IppW.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dc8d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6243fca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6243fca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8cd, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="IppW.lnk", cAlternateFileName="")) returned 0x277e88 [0278.258] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60dc8d00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6243fca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6243fca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8cd, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="IppW.lnk", cAlternateFileName="")) returned 0 [0278.258] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0278.258] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IppW.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ippw.lnk")) returned 1 [0278.259] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IppW.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ippw.lnk")) returned 0xffffffff [0278.259] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ca9680, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="iQCwpiwczJ95SBVO9.lnk", cAlternateFileName="IQCWPI~1.LNK")) returned 1 [0278.260] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iQCwpiwczJ95SBVO9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iqcwpiwczj95sbvo9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0278.260] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iQCwpiwczJ95SBVO9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iqcwpiwczj95sbvo9.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0278.261] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x245 [0278.261] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0278.261] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0278.309] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x245, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x245, lpOverlapped=0x0) returned 1 [0278.310] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x250, lpOverlapped=0x0) returned 1 [0278.311] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.787] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.807] CloseHandle (hObject=0xe0) returned 1 [0278.807] CloseHandle (hObject=0xf8) returned 1 [0278.810] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iQCwpiwczJ95SBVO9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iqcwpiwczj95sbvo9.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iQCwpiwczJ95SBVO9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iqcwpiwczj95sbvo9.lnk.ozq0")) returned 0 [0278.811] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iQCwpiwczJ95SBVO9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iqcwpiwczj95sbvo9.lnk.ozq0")) returned 0x20 [0278.811] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iQCwpiwczJ95SBVO9.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ca9680, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="iQCwpiwczJ95SBVO9.lnk", cAlternateFileName="IQCWPI~1.LNK")) returned 0x277ea0 [0278.812] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ca9680, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ca9680, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ca9680, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="iQCwpiwczJ95SBVO9.lnk", cAlternateFileName="IQCWPI~1.LNK")) returned 0 [0278.812] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0278.812] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iQCwpiwczJ95SBVO9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iqcwpiwczj95sbvo9.lnk")) returned 1 [0278.813] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\iQCwpiwczJ95SBVO9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iqcwpiwczj95sbvo9.lnk")) returned 0xffffffff [0278.813] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60501be0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60501be0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60501be0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="irvhR5JDEf4YLOv.lnk", cAlternateFileName="IRVHR5~1.LNK")) returned 1 [0278.817] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\irvhR5JDEf4YLOv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\irvhr5jdef4ylov.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0278.817] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\irvhR5JDEf4YLOv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\irvhr5jdef4ylov.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0278.819] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x23b [0278.819] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0278.819] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0278.892] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x23b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x23b, lpOverlapped=0x0) returned 1 [0278.897] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x240, lpOverlapped=0x0) returned 1 [0278.898] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0278.955] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0278.968] CloseHandle (hObject=0xf8) returned 1 [0278.968] CloseHandle (hObject=0xe0) returned 1 [0278.969] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\irvhR5JDEf4YLOv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\irvhr5jdef4ylov.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\irvhR5JDEf4YLOv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\irvhr5jdef4ylov.lnk.ozq0")) returned 0 [0278.970] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\irvhR5JDEf4YLOv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\irvhr5jdef4ylov.lnk.ozq0")) returned 0x20 [0278.970] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\irvhR5JDEf4YLOv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60501be0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60501be0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60501be0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="irvhR5JDEf4YLOv.lnk", cAlternateFileName="IRVHR5~1.LNK")) returned 0x277e98 [0278.970] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60501be0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60501be0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60501be0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x23b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="irvhR5JDEf4YLOv.lnk", cAlternateFileName="IRVHR5~1.LNK")) returned 0 [0278.970] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0278.970] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\irvhR5JDEf4YLOv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\irvhr5jdef4ylov.lnk")) returned 1 [0278.971] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\irvhR5JDEf4YLOv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\irvhr5jdef4ylov.lnk")) returned 0xffffffff [0278.971] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e61280, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e61280, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e61280, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="IyeFX.mkv.lnk", cAlternateFileName="IYEFXM~1.LNK")) returned 1 [0278.972] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IyeFX.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iyefx.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0278.972] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IyeFX.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iyefx.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0278.973] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x205 [0278.973] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0278.974] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0279.027] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x205, lpOverlapped=0x0) returned 1 [0279.028] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x210, lpOverlapped=0x0) returned 1 [0279.029] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.087] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.100] CloseHandle (hObject=0xe0) returned 1 [0279.100] CloseHandle (hObject=0xf8) returned 1 [0279.100] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IyeFX.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iyefx.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IyeFX.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iyefx.mkv.lnk.ozq0")) returned 0 [0279.101] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IyeFX.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iyefx.mkv.lnk.ozq0")) returned 0x20 [0279.101] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IyeFX.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e61280, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e61280, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e61280, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="IyeFX.mkv.lnk", cAlternateFileName="IYEFXM~1.LNK")) returned 0x277df0 [0279.101] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e61280, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e61280, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e61280, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="IyeFX.mkv.lnk", cAlternateFileName="IYEFXM~1.LNK")) returned 0 [0279.101] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0279.101] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IyeFX.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iyefx.mkv.lnk")) returned 1 [0279.102] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\IyeFX.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\iyefx.mkv.lnk")) returned 0xffffffff [0279.102] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee64ae0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62335300, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62335300, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="j1Z9hzpxaiA fc5AHQLs.lnk", cAlternateFileName="J1Z9HZ~1.LNK")) returned 1 [0279.103] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j1Z9hzpxaiA fc5AHQLs.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j1z9hzpxaia fc5ahqls.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0279.103] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j1Z9hzpxaiA fc5AHQLs.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j1z9hzpxaia fc5ahqls.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0279.104] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a3 [0279.104] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0279.104] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0279.151] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9a3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9a3, lpOverlapped=0x0) returned 1 [0279.151] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9b0, lpOverlapped=0x0) returned 1 [0279.152] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.212] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.225] CloseHandle (hObject=0xf8) returned 1 [0279.225] CloseHandle (hObject=0xe0) returned 1 [0279.225] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j1Z9hzpxaiA fc5AHQLs.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j1z9hzpxaia fc5ahqls.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j1Z9hzpxaiA fc5AHQLs.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j1z9hzpxaia fc5ahqls.lnk.ozq0")) returned 0 [0279.226] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j1Z9hzpxaiA fc5AHQLs.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j1z9hzpxaia fc5ahqls.lnk.ozq0")) returned 0x20 [0279.226] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j1Z9hzpxaiA fc5AHQLs.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee64ae0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62335300, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62335300, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a3, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="j1Z9hzpxaiA fc5AHQLs.lnk", cAlternateFileName="J1Z9HZ~1.LNK")) returned 0x277ea8 [0279.226] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ee64ae0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62335300, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62335300, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a3, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="j1Z9hzpxaiA fc5AHQLs.lnk", cAlternateFileName="J1Z9HZ~1.LNK")) returned 0 [0279.226] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0279.226] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j1Z9hzpxaiA fc5AHQLs.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j1z9hzpxaia fc5ahqls.lnk")) returned 1 [0279.227] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\j1Z9hzpxaiA fc5AHQLs.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j1z9hzpxaia fc5ahqls.lnk")) returned 0xffffffff [0279.227] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620f9e60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620f9e60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620f9e60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12ce, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="J7dFRxAASnOYdsy0E5.swf.lnk", cAlternateFileName="J7DFRX~1.LNK")) returned 1 [0279.228] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J7dFRxAASnOYdsy0E5.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j7dfrxaasnoydsy0e5.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0279.228] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J7dFRxAASnOYdsy0E5.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j7dfrxaasnoydsy0e5.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0279.229] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12ce [0279.229] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0279.230] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0279.277] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12ce, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x12ce, lpOverlapped=0x0) returned 1 [0279.278] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x12d0, lpOverlapped=0x0) returned 1 [0279.280] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.346] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.357] CloseHandle (hObject=0xe0) returned 1 [0279.357] CloseHandle (hObject=0xf8) returned 1 [0279.358] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J7dFRxAASnOYdsy0E5.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j7dfrxaasnoydsy0e5.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J7dFRxAASnOYdsy0E5.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j7dfrxaasnoydsy0e5.swf.lnk.ozq0")) returned 0 [0279.359] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J7dFRxAASnOYdsy0E5.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j7dfrxaasnoydsy0e5.swf.lnk.ozq0")) returned 0x20 [0279.359] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J7dFRxAASnOYdsy0E5.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620f9e60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620f9e60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620f9e60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12ce, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="J7dFRxAASnOYdsy0E5.swf.lnk", cAlternateFileName="J7DFRX~1.LNK")) returned 0x277ea8 [0279.359] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620f9e60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620f9e60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620f9e60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12ce, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="J7dFRxAASnOYdsy0E5.swf.lnk", cAlternateFileName="J7DFRX~1.LNK")) returned 0 [0279.359] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0279.359] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J7dFRxAASnOYdsy0E5.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j7dfrxaasnoydsy0e5.swf.lnk")) returned 1 [0279.360] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\J7dFRxAASnOYdsy0E5.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\j7dfrxaasnoydsy0e5.swf.lnk")) returned 0xffffffff [0279.360] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b52a20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b52a20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x364, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="JI7-QtBL.lnk", cAlternateFileName="")) returned 1 [0279.361] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JI7-QtBL.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ji7-qtbl.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0279.361] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JI7-QtBL.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ji7-qtbl.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0279.362] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x364 [0279.362] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0279.362] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0279.426] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x364, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x364, lpOverlapped=0x0) returned 1 [0279.427] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x370, lpOverlapped=0x0) returned 1 [0279.436] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.491] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.503] CloseHandle (hObject=0xf8) returned 1 [0279.503] CloseHandle (hObject=0xe0) returned 1 [0279.503] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JI7-QtBL.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ji7-qtbl.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JI7-QtBL.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ji7-qtbl.lnk.ozq0")) returned 0 [0279.504] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JI7-QtBL.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ji7-qtbl.lnk.ozq0")) returned 0x20 [0279.504] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JI7-QtBL.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b52a20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b52a20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x364, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="JI7-QtBL.lnk", cAlternateFileName="")) returned 0x277df0 [0279.505] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b52a20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b52a20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x364, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="JI7-QtBL.lnk", cAlternateFileName="")) returned 0 [0279.505] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0279.505] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JI7-QtBL.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ji7-qtbl.lnk")) returned 1 [0279.506] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\JI7-QtBL.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ji7-qtbl.lnk")) returned 0xffffffff [0279.506] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e72700, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e72700, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e72700, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpCgNv5R192-NbDa.pdf.lnk", cAlternateFileName="JPCGNV~1.LNK")) returned 1 [0279.506] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jpCgNv5R192-NbDa.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\jpcgnv5r192-nbda.pdf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0279.507] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jpCgNv5R192-NbDa.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\jpcgnv5r192-nbda.pdf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0279.508] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x240 [0279.508] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0279.508] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0279.565] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x240, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x240, lpOverlapped=0x0) returned 1 [0279.565] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x250, lpOverlapped=0x0) returned 1 [0279.567] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.625] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.637] CloseHandle (hObject=0xe0) returned 1 [0279.637] CloseHandle (hObject=0xf8) returned 1 [0279.637] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jpCgNv5R192-NbDa.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\jpcgnv5r192-nbda.pdf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jpCgNv5R192-NbDa.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\jpcgnv5r192-nbda.pdf.lnk.ozq0")) returned 0 [0279.639] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jpCgNv5R192-NbDa.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\jpcgnv5r192-nbda.pdf.lnk.ozq0")) returned 0x20 [0279.639] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jpCgNv5R192-NbDa.pdf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e72700, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e72700, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e72700, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="jpCgNv5R192-NbDa.pdf.lnk", cAlternateFileName="JPCGNV~1.LNK")) returned 0x277ea8 [0279.640] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e72700, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e72700, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e72700, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x240, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="jpCgNv5R192-NbDa.pdf.lnk", cAlternateFileName="JPCGNV~1.LNK")) returned 0 [0279.640] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0279.640] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jpCgNv5R192-NbDa.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\jpcgnv5r192-nbda.pdf.lnk")) returned 1 [0279.641] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\jpCgNv5R192-NbDa.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\jpcgnv5r192-nbda.pdf.lnk")) returned 0xffffffff [0279.641] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61774660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c5d3c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="KAj8ethB.lnk", cAlternateFileName="")) returned 1 [0279.641] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KAj8ethB.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kaj8ethb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0279.642] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KAj8ethB.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kaj8ethb.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0279.643] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x8fd [0279.643] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0279.643] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0279.691] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x8fd, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x8fd, lpOverlapped=0x0) returned 1 [0279.692] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x900, lpOverlapped=0x0) returned 1 [0279.693] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.760] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.772] CloseHandle (hObject=0xf8) returned 1 [0279.773] CloseHandle (hObject=0xe0) returned 1 [0279.773] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KAj8ethB.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kaj8ethb.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KAj8ethB.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kaj8ethb.lnk.ozq0")) returned 0 [0279.774] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KAj8ethB.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kaj8ethb.lnk.ozq0")) returned 0x20 [0279.774] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KAj8ethB.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61774660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c5d3c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="KAj8ethB.lnk", cAlternateFileName="")) returned 0x277df0 [0279.774] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61774660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c5d3c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x8fd, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="KAj8ethB.lnk", cAlternateFileName="")) returned 0 [0279.774] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0279.774] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KAj8ethB.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kaj8ethb.lnk")) returned 1 [0279.775] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\KAj8ethB.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kaj8ethb.lnk")) returned 0xffffffff [0279.775] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606326e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x606326e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x606326e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0x0, dwReserved1=0x0, cFileName="kd P.swf.lnk", cAlternateFileName="KDPSWF~1.LNK")) returned 1 [0279.776] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kd P.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kd p.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0279.776] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kd P.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kd p.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0279.777] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd75 [0279.777] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0279.777] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0279.823] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd75, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd75, lpOverlapped=0x0) returned 1 [0279.823] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd80, lpOverlapped=0x0) returned 1 [0279.824] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0279.893] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0279.904] CloseHandle (hObject=0xe0) returned 1 [0279.904] CloseHandle (hObject=0xf8) returned 1 [0279.904] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kd P.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kd p.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kd P.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kd p.swf.lnk.ozq0")) returned 0 [0279.905] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kd P.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kd p.swf.lnk.ozq0")) returned 0x20 [0279.905] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kd P.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606326e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x606326e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x606326e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="kd P.swf.lnk", cAlternateFileName="KDPSWF~1.LNK")) returned 0x277df0 [0279.905] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x606326e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x606326e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x606326e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd75, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="kd P.swf.lnk", cAlternateFileName="KDPSWF~1.LNK")) returned 0 [0279.905] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0279.905] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kd P.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kd p.swf.lnk")) returned 1 [0279.906] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kd P.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kd p.swf.lnk")) returned 0xffffffff [0279.906] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fb7ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fb7ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fb7ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe62, dwReserved0=0x0, dwReserved1=0x0, cFileName="kEMTRi5GHHDJ9.lnk", cAlternateFileName="KEMTRI~1.LNK")) returned 1 [0279.907] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEMTRi5GHHDJ9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kemtri5ghhdj9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0279.907] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEMTRi5GHHDJ9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kemtri5ghhdj9.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0279.908] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe62 [0279.908] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0279.908] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0279.951] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe62, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe62, lpOverlapped=0x0) returned 1 [0279.952] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe70, lpOverlapped=0x0) returned 1 [0279.953] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.048] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.059] CloseHandle (hObject=0xf8) returned 1 [0280.059] CloseHandle (hObject=0xe0) returned 1 [0280.060] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEMTRi5GHHDJ9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kemtri5ghhdj9.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEMTRi5GHHDJ9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kemtri5ghhdj9.lnk.ozq0")) returned 0 [0280.060] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEMTRi5GHHDJ9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kemtri5ghhdj9.lnk.ozq0")) returned 0x20 [0280.061] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEMTRi5GHHDJ9.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fb7ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fb7ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fb7ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe62, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="kEMTRi5GHHDJ9.lnk", cAlternateFileName="KEMTRI~1.LNK")) returned 0x277e98 [0280.061] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fb7ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fb7ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fb7ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe62, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="kEMTRi5GHHDJ9.lnk", cAlternateFileName="KEMTRI~1.LNK")) returned 0 [0280.061] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0280.061] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEMTRi5GHHDJ9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kemtri5ghhdj9.lnk")) returned 1 [0280.062] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kEMTRi5GHHDJ9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kemtri5ghhdj9.lnk")) returned 0xffffffff [0280.062] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f6bc20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f6bc20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f6bc20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="kjti A8Xs0HouGIY.flv.lnk", cAlternateFileName="KJTIA8~1.LNK")) returned 1 [0280.063] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kjti A8Xs0HouGIY.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kjti a8xs0hougiy.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0280.063] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kjti A8Xs0HouGIY.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kjti a8xs0hougiy.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0280.064] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a1 [0280.064] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0280.064] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0280.109] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9a1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9a1, lpOverlapped=0x0) returned 1 [0280.110] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9b0, lpOverlapped=0x0) returned 1 [0280.111] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.173] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.184] CloseHandle (hObject=0xe0) returned 1 [0280.184] CloseHandle (hObject=0xf8) returned 1 [0280.184] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kjti A8Xs0HouGIY.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kjti a8xs0hougiy.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kjti A8Xs0HouGIY.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kjti a8xs0hougiy.flv.lnk.ozq0")) returned 0 [0280.185] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kjti A8Xs0HouGIY.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kjti a8xs0hougiy.flv.lnk.ozq0")) returned 0x20 [0280.185] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kjti A8Xs0HouGIY.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f6bc20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f6bc20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f6bc20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="kjti A8Xs0HouGIY.flv.lnk", cAlternateFileName="KJTIA8~1.LNK")) returned 0x277ea8 [0280.186] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f6bc20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f6bc20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f6bc20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="kjti A8Xs0HouGIY.flv.lnk", cAlternateFileName="KJTIA8~1.LNK")) returned 0 [0280.186] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0280.186] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kjti A8Xs0HouGIY.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kjti a8xs0hougiy.flv.lnk")) returned 1 [0280.187] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kjti A8Xs0HouGIY.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kjti a8xs0hougiy.flv.lnk")) returned 0xffffffff [0280.187] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62087a40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62087a40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62087a40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe87, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="kKIhbNc8eyD7jZWg.lnk", cAlternateFileName="KKIHBN~1.LNK")) returned 1 [0280.187] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKIhbNc8eyD7jZWg.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kkihbnc8eyd7jzwg.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0280.187] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKIhbNc8eyD7jZWg.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kkihbnc8eyd7jzwg.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0280.189] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe87 [0280.189] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0280.189] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0280.234] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe87, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe87, lpOverlapped=0x0) returned 1 [0280.234] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe90, lpOverlapped=0x0) returned 1 [0280.235] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.294] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.306] CloseHandle (hObject=0xf8) returned 1 [0280.306] CloseHandle (hObject=0xe0) returned 1 [0280.306] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKIhbNc8eyD7jZWg.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kkihbnc8eyd7jzwg.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKIhbNc8eyD7jZWg.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kkihbnc8eyd7jzwg.lnk.ozq0")) returned 0 [0280.307] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKIhbNc8eyD7jZWg.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kkihbnc8eyd7jzwg.lnk.ozq0")) returned 0x20 [0280.307] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKIhbNc8eyD7jZWg.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62087a40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62087a40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62087a40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe87, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="kKIhbNc8eyD7jZWg.lnk", cAlternateFileName="KKIHBN~1.LNK")) returned 0x277ea0 [0280.307] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62087a40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62087a40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62087a40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe87, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="kKIhbNc8eyD7jZWg.lnk", cAlternateFileName="KKIHBN~1.LNK")) returned 0 [0280.307] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0280.307] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKIhbNc8eyD7jZWg.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kkihbnc8eyd7jzwg.lnk")) returned 1 [0280.308] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\kKIhbNc8eyD7jZWg.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\kkihbnc8eyd7jzwg.lnk")) returned 0xffffffff [0280.308] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x623815c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623815c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623815c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="l u8b.lnk", cAlternateFileName="LU8B~1.LNK")) returned 1 [0280.309] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l u8b.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\l u8b.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0280.309] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l u8b.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\l u8b.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0280.310] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3a0 [0280.310] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0280.311] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0280.355] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3a0, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3a0, lpOverlapped=0x0) returned 1 [0280.355] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3b0, lpOverlapped=0x0) returned 1 [0280.357] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.424] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.435] CloseHandle (hObject=0xe0) returned 1 [0280.436] CloseHandle (hObject=0xf8) returned 1 [0280.436] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l u8b.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\l u8b.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l u8b.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\l u8b.lnk.ozq0")) returned 0 [0280.437] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l u8b.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\l u8b.lnk.ozq0")) returned 0x20 [0280.437] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l u8b.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x623815c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623815c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623815c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="l u8b.lnk", cAlternateFileName="LU8B~1.LNK")) returned 0x277e88 [0280.437] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x623815c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623815c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623815c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="l u8b.lnk", cAlternateFileName="LU8B~1.LNK")) returned 0 [0280.437] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0280.437] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l u8b.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\l u8b.lnk")) returned 1 [0280.438] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\l u8b.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\l u8b.lnk")) returned 0xffffffff [0280.438] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60338b60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622e9040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622e9040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="LgTDXBTiw.lnk", cAlternateFileName="LGTDXB~1.LNK")) returned 1 [0280.438] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LgTDXBTiw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lgtdxbtiw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0280.439] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LgTDXBTiw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lgtdxbtiw.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0280.440] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2b [0280.440] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0280.440] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0280.486] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe2b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe2b, lpOverlapped=0x0) returned 1 [0280.486] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe30, lpOverlapped=0x0) returned 1 [0280.487] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.550] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.561] CloseHandle (hObject=0xf8) returned 1 [0280.561] CloseHandle (hObject=0xe0) returned 1 [0280.561] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LgTDXBTiw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lgtdxbtiw.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LgTDXBTiw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lgtdxbtiw.lnk.ozq0")) returned 0 [0280.562] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LgTDXBTiw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lgtdxbtiw.lnk.ozq0")) returned 0x20 [0280.562] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LgTDXBTiw.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60338b60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622e9040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622e9040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="LgTDXBTiw.lnk", cAlternateFileName="LGTDXB~1.LNK")) returned 0x277df0 [0280.563] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60338b60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x622e9040, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x622e9040, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe2b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="LgTDXBTiw.lnk", cAlternateFileName="LGTDXB~1.LNK")) returned 0 [0280.563] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0280.563] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LgTDXBTiw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lgtdxbtiw.lnk")) returned 1 [0280.564] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LgTDXBTiw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lgtdxbtiw.lnk")) returned 0xffffffff [0280.564] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6193d6e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6193d6e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6193d6e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ln-38tT.lnk", cAlternateFileName="")) returned 1 [0280.564] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ln-38tT.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ln-38tt.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0280.564] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ln-38tT.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ln-38tt.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0280.565] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe20 [0280.565] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0280.566] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0280.614] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe20, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe20, lpOverlapped=0x0) returned 1 [0280.615] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe30, lpOverlapped=0x0) returned 1 [0280.616] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.688] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.702] CloseHandle (hObject=0xe0) returned 1 [0280.702] CloseHandle (hObject=0xf8) returned 1 [0280.703] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ln-38tT.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ln-38tt.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ln-38tT.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ln-38tt.lnk.ozq0")) returned 0 [0280.704] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ln-38tT.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ln-38tt.lnk.ozq0")) returned 0x20 [0280.704] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ln-38tT.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6193d6e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6193d6e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6193d6e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ln-38tT.lnk", cAlternateFileName="")) returned 0x277e88 [0280.704] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6193d6e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6193d6e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6193d6e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ln-38tT.lnk", cAlternateFileName="")) returned 0 [0280.704] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0280.704] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ln-38tT.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ln-38tt.lnk")) returned 1 [0280.706] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ln-38tT.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ln-38tt.lnk")) returned 0xffffffff [0280.706] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc3aac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f0ac80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f0ac80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="LP0l.lnk", cAlternateFileName="")) returned 1 [0280.706] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LP0l.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lp0l.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0280.706] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LP0l.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lp0l.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0280.707] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1324 [0280.707] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0280.708] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0280.753] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1324, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1324, lpOverlapped=0x0) returned 1 [0280.754] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1330, lpOverlapped=0x0) returned 1 [0280.755] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.813] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.827] CloseHandle (hObject=0xf8) returned 1 [0280.827] CloseHandle (hObject=0xe0) returned 1 [0280.827] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LP0l.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lp0l.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LP0l.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lp0l.lnk.ozq0")) returned 0 [0280.828] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LP0l.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lp0l.lnk.ozq0")) returned 0x20 [0280.828] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LP0l.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc3aac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f0ac80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f0ac80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="LP0l.lnk", cAlternateFileName="")) returned 0x277e88 [0280.828] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc3aac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f0ac80, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f0ac80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="LP0l.lnk", cAlternateFileName="")) returned 0 [0280.829] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0280.829] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LP0l.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lp0l.lnk")) returned 1 [0280.830] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\LP0l.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\lp0l.lnk")) returned 0xffffffff [0280.830] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x625244e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625244e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625244e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="mNY18WJRDdr4YcmTRX2.lnk", cAlternateFileName="MNY18W~1.LNK")) returned 1 [0280.830] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNY18WJRDdr4YcmTRX2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mny18wjrddr4ycmtrx2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0280.830] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNY18WJRDdr4YcmTRX2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mny18wjrddr4ycmtrx2.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0280.831] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3e8 [0280.831] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0280.832] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0280.877] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3e8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3e8, lpOverlapped=0x0) returned 1 [0280.878] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0280.879] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0280.941] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0280.953] CloseHandle (hObject=0xe0) returned 1 [0280.954] CloseHandle (hObject=0xf8) returned 1 [0280.954] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNY18WJRDdr4YcmTRX2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mny18wjrddr4ycmtrx2.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNY18WJRDdr4YcmTRX2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mny18wjrddr4ycmtrx2.lnk.ozq0")) returned 0 [0280.955] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNY18WJRDdr4YcmTRX2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mny18wjrddr4ycmtrx2.lnk.ozq0")) returned 0x20 [0280.955] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNY18WJRDdr4YcmTRX2.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x625244e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625244e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625244e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="mNY18WJRDdr4YcmTRX2.lnk", cAlternateFileName="MNY18W~1.LNK")) returned 0x277ea0 [0280.955] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x625244e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625244e0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625244e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3e8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="mNY18WJRDdr4YcmTRX2.lnk", cAlternateFileName="MNY18W~1.LNK")) returned 0 [0280.955] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0280.955] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNY18WJRDdr4YcmTRX2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mny18wjrddr4ycmtrx2.lnk")) returned 1 [0280.956] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\mNY18WJRDdr4YcmTRX2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mny18wjrddr4ycmtrx2.lnk")) returned 0xffffffff [0280.956] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ea605c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62596900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62596900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 1 [0280.956] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0280.957] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0280.958] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4f3 [0280.958] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0280.958] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0281.005] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4f3, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4f3, lpOverlapped=0x0) returned 1 [0281.006] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500, lpOverlapped=0x0) returned 1 [0281.008] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.068] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.080] CloseHandle (hObject=0xf8) returned 1 [0281.080] CloseHandle (hObject=0xe0) returned 1 [0281.080] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.ozq0")) returned 0 [0281.081] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk.ozq0")) returned 0x20 [0281.081] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ea605c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62596900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62596900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 0x277df0 [0281.081] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ea605c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62596900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62596900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="My Music.lnk", cAlternateFileName="MYMUSI~1.LNK")) returned 0 [0281.081] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0281.082] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 1 [0281.083] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Music.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my music.lnk")) returned 0xffffffff [0281.083] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ef6f480, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d1baa0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 1 [0281.083] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0281.083] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0281.084] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x518 [0281.084] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0281.085] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0281.142] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x518, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x518, lpOverlapped=0x0) returned 1 [0281.143] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x520, lpOverlapped=0x0) returned 1 [0281.144] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.199] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.211] CloseHandle (hObject=0xe0) returned 1 [0281.211] CloseHandle (hObject=0xf8) returned 1 [0281.211] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.ozq0")) returned 0 [0281.212] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk.ozq0")) returned 0x20 [0281.212] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ef6f480, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d1baa0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 0x277df0 [0281.212] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ef6f480, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d1baa0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d1baa0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="My Pictures.lnk", cAlternateFileName="MYPICT~1.LNK")) returned 0 [0281.212] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0281.212] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 1 [0281.213] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Pictures.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my pictures.lnk")) returned 0xffffffff [0281.213] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc14960, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62250ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62250ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x4fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 1 [0281.214] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0281.214] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0281.215] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x4fe [0281.215] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0281.216] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0281.263] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x4fe, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x4fe, lpOverlapped=0x0) returned 1 [0281.264] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x500, lpOverlapped=0x0) returned 1 [0281.265] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.571] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.583] CloseHandle (hObject=0xf8) returned 1 [0281.584] CloseHandle (hObject=0xe0) returned 1 [0281.584] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.ozq0")) returned 0 [0281.585] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk.ozq0")) returned 0x20 [0281.585] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc14960, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62250ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62250ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x4fe, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 0x277df0 [0281.585] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fc14960, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62250ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62250ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x4fe, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="My Videos.lnk", cAlternateFileName="MYVIDE~1.LNK")) returned 0 [0281.585] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0281.585] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 1 [0281.586] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\My Videos.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\my videos.lnk")) returned 0xffffffff [0281.586] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61454980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61454980, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61454980, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x37f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MzzV-_1NZ17Jp.lnk", cAlternateFileName="MZZV-_~1.LNK")) returned 1 [0281.587] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MzzV-_1NZ17Jp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mzzv-_1nz17jp.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0281.587] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MzzV-_1NZ17Jp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mzzv-_1nz17jp.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0281.588] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37f [0281.588] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0281.591] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0281.640] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x37f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x37f, lpOverlapped=0x0) returned 1 [0281.642] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x380, lpOverlapped=0x0) returned 1 [0281.643] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.699] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.712] CloseHandle (hObject=0xe0) returned 1 [0281.712] CloseHandle (hObject=0xf8) returned 1 [0281.712] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MzzV-_1NZ17Jp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mzzv-_1nz17jp.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MzzV-_1NZ17Jp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mzzv-_1nz17jp.lnk.ozq0")) returned 0 [0281.713] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MzzV-_1NZ17Jp.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mzzv-_1nz17jp.lnk.ozq0")) returned 0x20 [0281.713] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MzzV-_1NZ17Jp.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61454980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61454980, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61454980, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x37f, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MzzV-_1NZ17Jp.lnk", cAlternateFileName="MZZV-_~1.LNK")) returned 0x277e98 [0281.723] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61454980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61454980, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61454980, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x37f, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="MzzV-_1NZ17Jp.lnk", cAlternateFileName="MZZV-_~1.LNK")) returned 0 [0281.723] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0281.723] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MzzV-_1NZ17Jp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mzzv-_1nz17jp.lnk")) returned 1 [0281.725] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\MzzV-_1NZ17Jp.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\mzzv-_1nz17jp.lnk")) returned 0xffffffff [0281.725] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6003efe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f30de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f30de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd5e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="n7-NSG5i2gOlYM.lnk", cAlternateFileName="N7-NSG~1.LNK")) returned 1 [0281.726] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7-NSG5i2gOlYM.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\n7-nsg5i2golym.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0281.726] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7-NSG5i2gOlYM.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\n7-nsg5i2golym.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0281.728] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd5e [0281.729] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0281.729] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0281.777] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd5e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd5e, lpOverlapped=0x0) returned 1 [0281.778] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd60, lpOverlapped=0x0) returned 1 [0281.780] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0281.838] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0281.850] CloseHandle (hObject=0xf8) returned 1 [0281.851] CloseHandle (hObject=0xe0) returned 1 [0281.851] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7-NSG5i2gOlYM.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\n7-nsg5i2golym.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7-NSG5i2gOlYM.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\n7-nsg5i2golym.lnk.ozq0")) returned 0 [0281.852] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7-NSG5i2gOlYM.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\n7-nsg5i2golym.lnk.ozq0")) returned 0x20 [0281.852] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7-NSG5i2gOlYM.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6003efe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f30de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f30de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd5e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="n7-NSG5i2gOlYM.lnk", cAlternateFileName="N7-NSG~1.LNK")) returned 0x277e98 [0281.852] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6003efe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f30de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f30de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd5e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="n7-NSG5i2gOlYM.lnk", cAlternateFileName="N7-NSG~1.LNK")) returned 0 [0281.852] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0281.852] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7-NSG5i2gOlYM.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\n7-nsg5i2golym.lnk")) returned 1 [0281.853] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\n7-NSG5i2gOlYM.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\n7-nsg5i2golym.lnk")) returned 0xffffffff [0281.853] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fb7ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fb7ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fb7ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1399, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="NjB5Cw.lnk", cAlternateFileName="")) returned 1 [0281.854] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjB5Cw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njb5cw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0281.854] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjB5Cw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njb5cw.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0281.855] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1399 [0281.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0281.856] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0281.906] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1399, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1399, lpOverlapped=0x0) returned 1 [0281.907] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x13a0, lpOverlapped=0x0) returned 1 [0281.909] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.351] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.365] CloseHandle (hObject=0xe0) returned 1 [0282.365] CloseHandle (hObject=0xf8) returned 1 [0282.366] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjB5Cw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njb5cw.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjB5Cw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njb5cw.lnk.ozq0")) returned 0 [0282.367] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjB5Cw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njb5cw.lnk.ozq0")) returned 0x20 [0282.367] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjB5Cw.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fb7ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fb7ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fb7ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1399, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="NjB5Cw.lnk", cAlternateFileName="")) returned 0x277e88 [0282.367] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60fb7ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60fb7ee0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60fb7ee0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1399, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="NjB5Cw.lnk", cAlternateFileName="")) returned 0 [0282.367] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0282.367] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjB5Cw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njb5cw.lnk")) returned 1 [0282.370] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjB5Cw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njb5cw.lnk")) returned 0xffffffff [0282.371] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fe75f60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c83520, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="NjH -aK2dwJ.lnk", cAlternateFileName="NJH-AK~1.LNK")) returned 1 [0282.371] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjH -aK2dwJ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njh -ak2dwj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0282.371] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjH -aK2dwJ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njh -ak2dwj.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0282.373] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x26d [0282.373] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0282.373] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0282.426] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x26d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x26d, lpOverlapped=0x0) returned 1 [0282.427] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x270, lpOverlapped=0x0) returned 1 [0282.428] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.498] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.510] CloseHandle (hObject=0xf8) returned 1 [0282.510] CloseHandle (hObject=0xe0) returned 1 [0282.510] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjH -aK2dwJ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njh -ak2dwj.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjH -aK2dwJ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njh -ak2dwj.lnk.ozq0")) returned 0 [0282.511] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjH -aK2dwJ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njh -ak2dwj.lnk.ozq0")) returned 0x20 [0282.511] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjH -aK2dwJ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fe75f60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c83520, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NjH -aK2dwJ.lnk", cAlternateFileName="NJH-AK~1.LNK")) returned 0x277df0 [0282.511] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fe75f60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c5d3c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c83520, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="NjH -aK2dwJ.lnk", cAlternateFileName="NJH-AK~1.LNK")) returned 0 [0282.511] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0282.511] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjH -aK2dwJ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njh -ak2dwj.lnk")) returned 1 [0282.512] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\NjH -aK2dwJ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\njh -ak2dwj.lnk")) returned 0xffffffff [0282.512] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619fbdc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619fbdc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619fbdc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x194e, dwReserved0=0x0, dwReserved1=0x0, cFileName="O1hW3prohD.lnk", cAlternateFileName="O1HW3P~1.LNK")) returned 1 [0282.513] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1hW3prohD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o1hw3prohd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0282.513] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1hW3prohD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o1hw3prohd.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0282.514] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194e [0282.514] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0282.514] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0282.571] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x194e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x194e, lpOverlapped=0x0) returned 1 [0282.572] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1950, lpOverlapped=0x0) returned 1 [0282.574] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.633] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.646] CloseHandle (hObject=0xe0) returned 1 [0282.646] CloseHandle (hObject=0xf8) returned 1 [0282.646] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1hW3prohD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o1hw3prohd.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1hW3prohD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o1hw3prohd.lnk.ozq0")) returned 0 [0282.647] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1hW3prohD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o1hw3prohd.lnk.ozq0")) returned 0x20 [0282.647] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1hW3prohD.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619fbdc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619fbdc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619fbdc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x194e, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="O1hW3prohD.lnk", cAlternateFileName="O1HW3P~1.LNK")) returned 0x277df0 [0282.647] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619fbdc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619fbdc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619fbdc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x194e, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="O1hW3prohD.lnk", cAlternateFileName="O1HW3P~1.LNK")) returned 0 [0282.647] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0282.647] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1hW3prohD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o1hw3prohd.lnk")) returned 1 [0282.648] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O1hW3prohD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o1hw3prohd.lnk")) returned 0xffffffff [0282.648] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f8a89c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="O388_.lnk", cAlternateFileName="")) returned 1 [0282.649] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O388_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o388_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0282.649] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O388_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o388_.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0282.650] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdfb [0282.650] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0282.651] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0282.697] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdfb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xdfb, lpOverlapped=0x0) returned 1 [0282.698] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe00, lpOverlapped=0x0) returned 1 [0282.699] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.777] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.789] CloseHandle (hObject=0xf8) returned 1 [0282.789] CloseHandle (hObject=0xe0) returned 1 [0282.789] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O388_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o388_.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O388_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o388_.lnk.ozq0")) returned 0 [0282.790] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O388_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o388_.lnk.ozq0")) returned 0x20 [0282.790] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O388_.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f8a89c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="O388_.lnk", cAlternateFileName="")) returned 0x277e88 [0282.790] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f8a89c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620d3d00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620d3d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xdfb, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="O388_.lnk", cAlternateFileName="")) returned 0 [0282.790] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0282.790] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O388_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o388_.lnk")) returned 1 [0282.792] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\O388_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\o388_.lnk")) returned 0xffffffff [0282.792] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61180f60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61180f60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61180f60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x187a, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="oCUQ.lnk", cAlternateFileName="")) returned 1 [0282.792] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oCUQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ocuq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0282.793] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oCUQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ocuq.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0282.794] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x187a [0282.794] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0282.794] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0282.859] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x187a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x187a, lpOverlapped=0x0) returned 1 [0282.859] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1880, lpOverlapped=0x0) returned 1 [0282.861] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0282.919] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0282.930] CloseHandle (hObject=0xe0) returned 1 [0282.930] CloseHandle (hObject=0xf8) returned 1 [0282.931] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oCUQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ocuq.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oCUQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ocuq.lnk.ozq0")) returned 0 [0282.931] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oCUQ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ocuq.lnk.ozq0")) returned 0x20 [0282.932] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oCUQ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61180f60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61180f60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61180f60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x187a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="oCUQ.lnk", cAlternateFileName="")) returned 0x277e88 [0282.932] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61180f60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61180f60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61180f60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x187a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="oCUQ.lnk", cAlternateFileName="")) returned 0 [0282.932] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0282.932] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oCUQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ocuq.lnk")) returned 1 [0282.933] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\oCUQ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ocuq.lnk")) returned 0xffffffff [0282.933] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f45ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f45ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f45ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1964, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ohRGVi2kiuqL.lnk", cAlternateFileName="OHRGVI~1.LNK")) returned 1 [0282.933] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohRGVi2kiuqL.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ohrgvi2kiuql.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0282.934] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohRGVi2kiuqL.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ohrgvi2kiuql.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0282.935] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1964 [0282.935] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0282.935] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0282.989] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1964, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1964, lpOverlapped=0x0) returned 1 [0282.990] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1970, lpOverlapped=0x0) returned 1 [0282.991] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.053] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.064] CloseHandle (hObject=0xf8) returned 1 [0283.064] CloseHandle (hObject=0xe0) returned 1 [0283.065] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohRGVi2kiuqL.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ohrgvi2kiuql.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohRGVi2kiuqL.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ohrgvi2kiuql.lnk.ozq0")) returned 0 [0283.065] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohRGVi2kiuqL.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ohrgvi2kiuql.lnk.ozq0")) returned 0x20 [0283.066] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohRGVi2kiuqL.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f45ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f45ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f45ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1964, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ohRGVi2kiuqL.lnk", cAlternateFileName="OHRGVI~1.LNK")) returned 0x277e98 [0283.066] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f45ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f45ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f45ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1964, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ohRGVi2kiuqL.lnk", cAlternateFileName="OHRGVI~1.LNK")) returned 0 [0283.066] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0283.066] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohRGVi2kiuqL.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ohrgvi2kiuql.lnk")) returned 1 [0283.067] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ohRGVi2kiuqL.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ohrgvi2kiuql.lnk")) returned 0xffffffff [0283.067] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61858ea0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61858ea0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61858ea0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="p8TF2gmmJ0rH71GOk.lnk", cAlternateFileName="P8TF2G~1.LNK")) returned 1 [0283.067] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p8TF2gmmJ0rH71GOk.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\p8tf2gmmj0rh71gok.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0283.067] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p8TF2gmmJ0rH71GOk.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\p8tf2gmmj0rh71gok.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0283.068] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x145e [0283.069] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0283.069] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0283.113] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x145e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x145e, lpOverlapped=0x0) returned 1 [0283.114] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1460, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1460, lpOverlapped=0x0) returned 1 [0283.115] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.175] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.188] CloseHandle (hObject=0xe0) returned 1 [0283.188] CloseHandle (hObject=0xf8) returned 1 [0283.190] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p8TF2gmmJ0rH71GOk.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\p8tf2gmmj0rh71gok.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p8TF2gmmJ0rH71GOk.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\p8tf2gmmj0rh71gok.lnk.ozq0")) returned 0 [0283.191] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p8TF2gmmJ0rH71GOk.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\p8tf2gmmj0rh71gok.lnk.ozq0")) returned 0x20 [0283.191] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p8TF2gmmJ0rH71GOk.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61858ea0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61858ea0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61858ea0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="p8TF2gmmJ0rH71GOk.lnk", cAlternateFileName="P8TF2G~1.LNK")) returned 0x277ea0 [0283.191] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61858ea0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61858ea0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61858ea0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="p8TF2gmmJ0rH71GOk.lnk", cAlternateFileName="P8TF2G~1.LNK")) returned 0 [0283.191] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0283.191] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p8TF2gmmJ0rH71GOk.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\p8tf2gmmj0rh71gok.lnk")) returned 1 [0283.192] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\p8TF2gmmJ0rH71GOk.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\p8tf2gmmj0rh71gok.lnk")) returned 0xffffffff [0283.192] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b52a20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b52a20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1354, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="pYjJHXj.lnk", cAlternateFileName="")) returned 1 [0283.193] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pYjJHXj.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\pyjjhxj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0283.193] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pYjJHXj.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\pyjjhxj.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0283.194] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1354 [0283.194] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0283.194] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0283.238] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1354, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1354, lpOverlapped=0x0) returned 1 [0283.239] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1360, lpOverlapped=0x0) returned 1 [0283.240] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.332] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.347] CloseHandle (hObject=0xf8) returned 1 [0283.347] CloseHandle (hObject=0xe0) returned 1 [0283.348] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pYjJHXj.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\pyjjhxj.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pYjJHXj.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\pyjjhxj.lnk.ozq0")) returned 0 [0283.348] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pYjJHXj.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\pyjjhxj.lnk.ozq0")) returned 0x20 [0283.349] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pYjJHXj.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b52a20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b52a20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1354, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="pYjJHXj.lnk", cAlternateFileName="")) returned 0x277e88 [0283.349] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b52a20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b52a20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1354, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="pYjJHXj.lnk", cAlternateFileName="")) returned 0 [0283.349] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0283.349] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pYjJHXj.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\pyjjhxj.lnk")) returned 1 [0283.350] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\pYjJHXj.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\pyjjhxj.lnk")) returned 0xffffffff [0283.350] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614a0c40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614a0c40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614a0c40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="qDwD.lnk", cAlternateFileName="")) returned 1 [0283.350] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qDwD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qdwd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0283.351] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qDwD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qdwd.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0283.352] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x283 [0283.352] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0283.352] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0283.397] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x283, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x283, lpOverlapped=0x0) returned 1 [0283.398] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x290, lpOverlapped=0x0) returned 1 [0283.399] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.464] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.476] CloseHandle (hObject=0xe0) returned 1 [0283.476] CloseHandle (hObject=0xf8) returned 1 [0283.476] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qDwD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qdwd.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qDwD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qdwd.lnk.ozq0")) returned 0 [0283.477] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qDwD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qdwd.lnk.ozq0")) returned 0x20 [0283.477] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qDwD.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614a0c40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614a0c40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614a0c40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="qDwD.lnk", cAlternateFileName="")) returned 0x277e88 [0283.477] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614a0c40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614a0c40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614a0c40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x283, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="qDwD.lnk", cAlternateFileName="")) returned 0 [0283.477] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0283.477] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qDwD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qdwd.lnk")) returned 1 [0283.478] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\qDwD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qdwd.lnk")) returned 0xffffffff [0283.478] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60469660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60469660, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60469660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="QfVXm_sZgS-JCNLM.flv.lnk", cAlternateFileName="QFVXM_~1.LNK")) returned 1 [0283.479] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QfVXm_sZgS-JCNLM.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qfvxm_szgs-jcnlm.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0283.479] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QfVXm_sZgS-JCNLM.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qfvxm_szgs-jcnlm.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0283.480] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xee2 [0283.480] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0283.480] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0283.543] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xee2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xee2, lpOverlapped=0x0) returned 1 [0283.544] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xef0, lpOverlapped=0x0) returned 1 [0283.545] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.609] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.623] CloseHandle (hObject=0xf8) returned 1 [0283.624] CloseHandle (hObject=0xe0) returned 1 [0283.624] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QfVXm_sZgS-JCNLM.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qfvxm_szgs-jcnlm.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QfVXm_sZgS-JCNLM.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qfvxm_szgs-jcnlm.flv.lnk.ozq0")) returned 0 [0283.625] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QfVXm_sZgS-JCNLM.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qfvxm_szgs-jcnlm.flv.lnk.ozq0")) returned 0x20 [0283.625] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QfVXm_sZgS-JCNLM.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60469660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60469660, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60469660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="QfVXm_sZgS-JCNLM.flv.lnk", cAlternateFileName="QFVXM_~1.LNK")) returned 0x277ea8 [0283.625] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60469660, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60469660, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60469660, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="QfVXm_sZgS-JCNLM.flv.lnk", cAlternateFileName="QFVXM_~1.LNK")) returned 0 [0283.625] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0283.625] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QfVXm_sZgS-JCNLM.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qfvxm_szgs-jcnlm.flv.lnk")) returned 1 [0283.626] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QfVXm_sZgS-JCNLM.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qfvxm_szgs-jcnlm.flv.lnk")) returned 0xffffffff [0283.626] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60338b60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60338b60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60338b60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="QHeF S5LkNiBYp2oWu.lnk", cAlternateFileName="QHEFS5~1.LNK")) returned 1 [0283.627] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QHeF S5LkNiBYp2oWu.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qhef s5lknibyp2owu.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0283.627] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QHeF S5LkNiBYp2oWu.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qhef s5lknibyp2owu.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0283.628] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa16 [0283.628] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0283.629] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0283.691] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa16, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xa16, lpOverlapped=0x0) returned 1 [0283.692] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa20, lpOverlapped=0x0) returned 1 [0283.693] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.761] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.776] CloseHandle (hObject=0xe0) returned 1 [0283.777] CloseHandle (hObject=0xf8) returned 1 [0283.777] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QHeF S5LkNiBYp2oWu.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qhef s5lknibyp2owu.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QHeF S5LkNiBYp2oWu.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qhef s5lknibyp2owu.lnk.ozq0")) returned 0 [0283.778] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QHeF S5LkNiBYp2oWu.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qhef s5lknibyp2owu.lnk.ozq0")) returned 0x20 [0283.778] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QHeF S5LkNiBYp2oWu.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60338b60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60338b60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60338b60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="QHeF S5LkNiBYp2oWu.lnk", cAlternateFileName="QHEFS5~1.LNK")) returned 0x277ea0 [0283.778] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60338b60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60338b60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60338b60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="QHeF S5LkNiBYp2oWu.lnk", cAlternateFileName="QHEFS5~1.LNK")) returned 0 [0283.778] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0283.778] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QHeF S5LkNiBYp2oWu.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qhef s5lknibyp2owu.lnk")) returned 1 [0283.780] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QHeF S5LkNiBYp2oWu.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qhef s5lknibyp2owu.lnk")) returned 0xffffffff [0283.780] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6115ae00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6115ae00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6115ae00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x95c, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="QkU2.lnk", cAlternateFileName="")) returned 1 [0283.781] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkU2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qku2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0283.781] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkU2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qku2.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0283.782] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x95c [0283.782] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0283.783] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0283.842] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x95c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x95c, lpOverlapped=0x0) returned 1 [0283.842] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x960, lpOverlapped=0x0) returned 1 [0283.843] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0283.914] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0283.925] CloseHandle (hObject=0xf8) returned 1 [0283.925] CloseHandle (hObject=0xe0) returned 1 [0283.925] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkU2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qku2.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkU2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qku2.lnk.ozq0")) returned 0 [0283.926] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkU2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qku2.lnk.ozq0")) returned 0x20 [0283.926] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkU2.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6115ae00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6115ae00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6115ae00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x95c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="QkU2.lnk", cAlternateFileName="")) returned 0x277e88 [0283.926] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6115ae00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6115ae00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6115ae00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x95c, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="QkU2.lnk", cAlternateFileName="")) returned 0 [0283.926] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0283.926] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkU2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qku2.lnk")) returned 1 [0283.927] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\QkU2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\qku2.lnk")) returned 0xffffffff [0283.927] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62419b40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62419b40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62419b40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Q_ST4rKO.lnk", cAlternateFileName="")) returned 1 [0283.928] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q_ST4rKO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\q_st4rko.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0283.928] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q_ST4rKO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\q_st4rko.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0283.929] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe2f [0283.929] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0283.930] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0283.975] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe2f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe2f, lpOverlapped=0x0) returned 1 [0283.988] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe30, lpOverlapped=0x0) returned 1 [0283.989] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.057] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.073] CloseHandle (hObject=0xe0) returned 1 [0284.073] CloseHandle (hObject=0xf8) returned 1 [0284.073] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q_ST4rKO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\q_st4rko.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q_ST4rKO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\q_st4rko.lnk.ozq0")) returned 0 [0284.074] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q_ST4rKO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\q_st4rko.lnk.ozq0")) returned 0x20 [0284.074] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q_ST4rKO.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62419b40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62419b40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62419b40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Q_ST4rKO.lnk", cAlternateFileName="")) returned 0x277df0 [0284.074] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62419b40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62419b40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62419b40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Q_ST4rKO.lnk", cAlternateFileName="")) returned 0 [0284.074] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0284.074] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q_ST4rKO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\q_st4rko.lnk")) returned 1 [0284.076] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Q_ST4rKO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\q_st4rko.lnk")) returned 0xffffffff [0284.076] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f45ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f45ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f45ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x0, dwReserved1=0x0, cFileName="R7gAzm.lnk", cAlternateFileName="")) returned 1 [0284.076] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7gAzm.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7gazm.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0284.076] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7gAzm.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7gazm.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0284.077] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x358 [0284.077] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0284.077] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0284.128] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x358, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x358, lpOverlapped=0x0) returned 1 [0284.129] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x360, lpOverlapped=0x0) returned 1 [0284.130] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.189] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.202] CloseHandle (hObject=0xf8) returned 1 [0284.202] CloseHandle (hObject=0xe0) returned 1 [0284.202] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7gAzm.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7gazm.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7gAzm.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7gazm.lnk.ozq0")) returned 0 [0284.203] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7gAzm.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7gazm.lnk.ozq0")) returned 0x20 [0284.203] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7gAzm.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f45ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f45ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f45ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="R7gAzm.lnk", cAlternateFileName="")) returned 0x277e88 [0284.203] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60f45ac0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60f45ac0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60f45ac0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x358, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="R7gAzm.lnk", cAlternateFileName="")) returned 0 [0284.203] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0284.203] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7gAzm.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7gazm.lnk")) returned 1 [0284.204] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7gAzm.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7gazm.lnk")) returned 0xffffffff [0284.204] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e14fc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e14fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e14fc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="R7JqB09hkduIJ3n --.lnk", cAlternateFileName="R7JQB0~1.LNK")) returned 1 [0284.205] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7JqB09hkduIJ3n --.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7jqb09hkduij3n --.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0284.205] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7JqB09hkduIJ3n --.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7jqb09hkduij3n --.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0284.206] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x19a6 [0284.206] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0284.207] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0284.546] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x19a6, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x19a6, lpOverlapped=0x0) returned 1 [0284.547] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x19b0, lpOverlapped=0x0) returned 1 [0284.549] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.620] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.631] CloseHandle (hObject=0xe0) returned 1 [0284.631] CloseHandle (hObject=0xf8) returned 1 [0284.631] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7JqB09hkduIJ3n --.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7jqb09hkduij3n --.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7JqB09hkduIJ3n --.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7jqb09hkduij3n --.lnk.ozq0")) returned 0 [0284.632] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7JqB09hkduIJ3n --.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7jqb09hkduij3n --.lnk.ozq0")) returned 0x20 [0284.632] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7JqB09hkduIJ3n --.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e14fc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e14fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e14fc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="R7JqB09hkduIJ3n --.lnk", cAlternateFileName="R7JQB0~1.LNK")) returned 0x277ea0 [0284.632] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e14fc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e14fc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e14fc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="R7JqB09hkduIJ3n --.lnk", cAlternateFileName="R7JQB0~1.LNK")) returned 0 [0284.633] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0284.633] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7JqB09hkduIJ3n --.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7jqb09hkduij3n --.lnk")) returned 1 [0284.634] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\R7JqB09hkduIJ3n --.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\r7jqb09hkduij3n --.lnk")) returned 0xffffffff [0284.634] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615391c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x615391c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x615391c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="rbehdQk0d1DYOGy D.lnk", cAlternateFileName="RBEHDQ~1.LNK")) returned 1 [0284.634] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rbehdQk0d1DYOGy D.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rbehdqk0d1dyogy d.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0284.634] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rbehdQk0d1DYOGy D.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rbehdqk0d1dyogy d.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0284.635] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1997 [0284.635] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0284.636] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0284.684] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1997, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1997, lpOverlapped=0x0) returned 1 [0284.685] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x19a0, lpOverlapped=0x0) returned 1 [0284.689] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.752] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.765] CloseHandle (hObject=0xf8) returned 1 [0284.765] CloseHandle (hObject=0xe0) returned 1 [0284.766] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rbehdQk0d1DYOGy D.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rbehdqk0d1dyogy d.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rbehdQk0d1DYOGy D.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rbehdqk0d1dyogy d.lnk.ozq0")) returned 0 [0284.766] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rbehdQk0d1DYOGy D.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rbehdqk0d1dyogy d.lnk.ozq0")) returned 0x20 [0284.766] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rbehdQk0d1DYOGy D.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615391c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x615391c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x615391c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="rbehdQk0d1DYOGy D.lnk", cAlternateFileName="RBEHDQ~1.LNK")) returned 0x277ea0 [0284.767] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x615391c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x615391c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x615391c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1997, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="rbehdQk0d1DYOGy D.lnk", cAlternateFileName="RBEHDQ~1.LNK")) returned 0 [0284.767] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0284.767] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rbehdQk0d1DYOGy D.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rbehdqk0d1dyogy d.lnk")) returned 1 [0284.768] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rbehdQk0d1DYOGy D.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rbehdqk0d1dyogy d.lnk")) returned 0xffffffff [0284.768] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61bc4e40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61bc4e40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61bc4e40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Rd3G.lnk", cAlternateFileName="")) returned 1 [0284.768] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rd3G.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rd3g.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0284.769] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rd3G.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rd3g.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0284.770] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1412 [0284.770] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0284.770] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0284.818] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1412, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1412, lpOverlapped=0x0) returned 1 [0284.818] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1420, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1420, lpOverlapped=0x0) returned 1 [0284.819] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0284.879] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0284.890] CloseHandle (hObject=0xe0) returned 1 [0284.891] CloseHandle (hObject=0xf8) returned 1 [0284.891] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rd3G.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rd3g.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rd3G.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rd3g.lnk.ozq0")) returned 0 [0284.892] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rd3G.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rd3g.lnk.ozq0")) returned 0x20 [0284.892] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rd3G.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61bc4e40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61bc4e40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61bc4e40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Rd3G.lnk", cAlternateFileName="")) returned 0x277e88 [0284.892] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61bc4e40, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61bc4e40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61bc4e40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Rd3G.lnk", cAlternateFileName="")) returned 0 [0284.892] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0284.892] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rd3G.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rd3g.lnk")) returned 1 [0284.893] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Rd3G.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rd3g.lnk")) returned 0xffffffff [0284.893] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e4df2e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625707a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625707a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Roaming.lnk", cAlternateFileName="")) returned 1 [0284.894] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0284.894] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0284.895] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x2e2 [0284.895] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0284.895] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0284.943] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x2e2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x2e2, lpOverlapped=0x0) returned 1 [0284.944] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x2f0, lpOverlapped=0x0) returned 1 [0284.945] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.006] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.017] CloseHandle (hObject=0xf8) returned 1 [0285.017] CloseHandle (hObject=0xe0) returned 1 [0285.018] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.ozq0")) returned 0 [0285.018] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk.ozq0")) returned 0x20 [0285.019] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e4df2e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625707a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625707a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Roaming.lnk", cAlternateFileName="")) returned 0x277e88 [0285.019] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e4df2e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x625707a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x625707a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Roaming.lnk", cAlternateFileName="")) returned 0 [0285.019] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0285.019] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 1 [0285.020] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Roaming.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\roaming.lnk")) returned 0xffffffff [0285.020] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61513060, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61513060, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61513060, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="rp1JW ERqFC.lnk", cAlternateFileName="RP1JWE~1.LNK")) returned 1 [0285.021] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rp1JW ERqFC.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rp1jw erqfc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0285.021] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rp1JW ERqFC.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rp1jw erqfc.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0285.022] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x375 [0285.022] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0285.022] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0285.070] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x375, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x375, lpOverlapped=0x0) returned 1 [0285.071] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x380, lpOverlapped=0x0) returned 1 [0285.072] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.142] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.154] CloseHandle (hObject=0xe0) returned 1 [0285.154] CloseHandle (hObject=0xf8) returned 1 [0285.154] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rp1JW ERqFC.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rp1jw erqfc.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rp1JW ERqFC.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rp1jw erqfc.lnk.ozq0")) returned 0 [0285.155] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rp1JW ERqFC.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rp1jw erqfc.lnk.ozq0")) returned 0x20 [0285.155] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rp1JW ERqFC.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61513060, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61513060, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61513060, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="rp1JW ERqFC.lnk", cAlternateFileName="RP1JWE~1.LNK")) returned 0x277df0 [0285.155] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61513060, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61513060, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61513060, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x375, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="rp1JW ERqFC.lnk", cAlternateFileName="RP1JWE~1.LNK")) returned 0 [0285.155] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0285.155] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rp1JW ERqFC.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rp1jw erqfc.lnk")) returned 1 [0285.156] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\rp1JW ERqFC.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\rp1jw erqfc.lnk")) returned 0xffffffff [0285.156] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6128b900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6128b900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6128b900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="S hwNWZrO.lnk", cAlternateFileName="SHWNWZ~1.LNK")) returned 1 [0285.157] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S hwNWZrO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\s hwnwzro.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0285.157] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S hwNWZrO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\s hwnwzro.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0285.158] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xec2 [0285.158] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0285.158] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0285.205] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xec2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xec2, lpOverlapped=0x0) returned 1 [0285.206] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xed0, lpOverlapped=0x0) returned 1 [0285.207] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.269] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.281] CloseHandle (hObject=0xf8) returned 1 [0285.281] CloseHandle (hObject=0xe0) returned 1 [0285.281] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S hwNWZrO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\s hwnwzro.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S hwNWZrO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\s hwnwzro.lnk.ozq0")) returned 0 [0285.282] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S hwNWZrO.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\s hwnwzro.lnk.ozq0")) returned 0x20 [0285.282] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S hwNWZrO.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6128b900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6128b900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6128b900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="S hwNWZrO.lnk", cAlternateFileName="SHWNWZ~1.LNK")) returned 0x277df0 [0285.282] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6128b900, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6128b900, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6128b900, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="S hwNWZrO.lnk", cAlternateFileName="SHWNWZ~1.LNK")) returned 0 [0285.282] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0285.282] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S hwNWZrO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\s hwnwzro.lnk")) returned 1 [0285.283] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\S hwNWZrO.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\s hwnwzro.lnk")) returned 0xffffffff [0285.283] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6235b460, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6235b460, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6235b460, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="siq1MOa.lnk", cAlternateFileName="")) returned 1 [0285.284] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\siq1MOa.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\siq1moa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0285.284] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\siq1MOa.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\siq1moa.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0285.285] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x211 [0285.285] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0285.285] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0285.332] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x211, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x211, lpOverlapped=0x0) returned 1 [0285.333] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x220, lpOverlapped=0x0) returned 1 [0285.334] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.407] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.419] CloseHandle (hObject=0xe0) returned 1 [0285.419] CloseHandle (hObject=0xf8) returned 1 [0285.419] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\siq1MOa.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\siq1moa.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\siq1MOa.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\siq1moa.lnk.ozq0")) returned 0 [0285.420] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\siq1MOa.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\siq1moa.lnk.ozq0")) returned 0x20 [0285.420] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\siq1MOa.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6235b460, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6235b460, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6235b460, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="siq1MOa.lnk", cAlternateFileName="")) returned 0x277e88 [0285.420] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6235b460, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6235b460, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6235b460, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="siq1MOa.lnk", cAlternateFileName="")) returned 0 [0285.420] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0285.420] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\siq1MOa.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\siq1moa.lnk")) returned 1 [0285.421] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\siq1MOa.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\siq1moa.lnk")) returned 0xffffffff [0285.421] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x617c0920, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x617c0920, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x617c0920, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xdac, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="SO2aePlsf.swf.lnk", cAlternateFileName="SO2AEP~1.LNK")) returned 1 [0285.422] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO2aePlsf.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\so2aeplsf.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0285.422] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO2aePlsf.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\so2aeplsf.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0285.423] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xdac [0285.423] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0285.423] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0285.481] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xdac, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xdac, lpOverlapped=0x0) returned 1 [0285.481] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xdb0, lpOverlapped=0x0) returned 1 [0285.482] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.542] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.561] CloseHandle (hObject=0xf8) returned 1 [0285.562] CloseHandle (hObject=0xe0) returned 1 [0285.563] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO2aePlsf.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\so2aeplsf.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO2aePlsf.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\so2aeplsf.swf.lnk.ozq0")) returned 0 [0285.565] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO2aePlsf.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\so2aeplsf.swf.lnk.ozq0")) returned 0x20 [0285.566] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO2aePlsf.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x617c0920, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x617c0920, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x617c0920, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xdac, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SO2aePlsf.swf.lnk", cAlternateFileName="SO2AEP~1.LNK")) returned 0x277e98 [0285.566] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x617c0920, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x617c0920, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x617c0920, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xdac, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="SO2aePlsf.swf.lnk", cAlternateFileName="SO2AEP~1.LNK")) returned 0 [0285.566] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0285.566] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO2aePlsf.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\so2aeplsf.swf.lnk")) returned 1 [0285.568] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\SO2aePlsf.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\so2aeplsf.swf.lnk")) returned 0xffffffff [0285.568] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60443500, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60443500, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60443500, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="T0Mi8N0RQ1O.lnk", cAlternateFileName="T0MI8N~1.LNK")) returned 1 [0285.569] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0Mi8N0RQ1O.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t0mi8n0rq1o.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0285.569] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0Mi8N0RQ1O.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t0mi8n0rq1o.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0285.571] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed8 [0285.571] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0285.571] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0285.633] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xed8, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xed8, lpOverlapped=0x0) returned 1 [0285.634] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xee0, lpOverlapped=0x0) returned 1 [0285.636] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.699] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.711] CloseHandle (hObject=0xe0) returned 1 [0285.712] CloseHandle (hObject=0xf8) returned 1 [0285.712] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0Mi8N0RQ1O.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t0mi8n0rq1o.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0Mi8N0RQ1O.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t0mi8n0rq1o.lnk.ozq0")) returned 0 [0285.713] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0Mi8N0RQ1O.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t0mi8n0rq1o.lnk.ozq0")) returned 0x20 [0285.713] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0Mi8N0RQ1O.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60443500, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60443500, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60443500, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="T0Mi8N0RQ1O.lnk", cAlternateFileName="T0MI8N~1.LNK")) returned 0x277df0 [0285.713] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60443500, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60443500, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60443500, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="T0Mi8N0RQ1O.lnk", cAlternateFileName="T0MI8N~1.LNK")) returned 0 [0285.713] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0285.713] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0Mi8N0RQ1O.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t0mi8n0rq1o.lnk")) returned 1 [0285.714] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T0Mi8N0RQ1O.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t0mi8n0rq1o.lnk")) returned 0xffffffff [0285.714] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61349fe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61349fe0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61349fe0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="tLXzD.lnk", cAlternateFileName="")) returned 1 [0285.715] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLXzD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tlxzd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0285.715] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLXzD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tlxzd.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0285.716] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13bb [0285.716] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0285.716] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0285.770] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13bb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x13bb, lpOverlapped=0x0) returned 1 [0285.771] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x13c0, lpOverlapped=0x0) returned 1 [0285.772] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.835] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.849] CloseHandle (hObject=0xf8) returned 1 [0285.849] CloseHandle (hObject=0xe0) returned 1 [0285.849] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLXzD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tlxzd.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLXzD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tlxzd.lnk.ozq0")) returned 0 [0285.850] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLXzD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tlxzd.lnk.ozq0")) returned 0x20 [0285.850] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLXzD.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61349fe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61349fe0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61349fe0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13bb, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="tLXzD.lnk", cAlternateFileName="")) returned 0x277e88 [0285.851] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61349fe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61349fe0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61349fe0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13bb, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="tLXzD.lnk", cAlternateFileName="")) returned 0 [0285.851] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0285.851] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLXzD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tlxzd.lnk")) returned 1 [0285.852] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tLXzD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tlxzd.lnk")) returned 0xffffffff [0285.852] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f30de0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f30de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f30de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12be, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="tvrl gxaQ-6.swf.lnk", cAlternateFileName="TVRLGX~1.LNK")) returned 1 [0285.852] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrl gxaQ-6.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvrl gxaq-6.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0285.852] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrl gxaQ-6.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvrl gxaq-6.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0285.854] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x12be [0285.854] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0285.854] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0285.909] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x12be, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x12be, lpOverlapped=0x0) returned 1 [0285.911] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x12c0, lpOverlapped=0x0) returned 1 [0285.912] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0285.975] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0285.987] CloseHandle (hObject=0xe0) returned 1 [0285.987] CloseHandle (hObject=0xf8) returned 1 [0285.987] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrl gxaQ-6.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvrl gxaq-6.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrl gxaQ-6.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvrl gxaq-6.swf.lnk.ozq0")) returned 0 [0285.988] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrl gxaQ-6.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvrl gxaq-6.swf.lnk.ozq0")) returned 0x20 [0285.988] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrl gxaQ-6.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f30de0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f30de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f30de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12be, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="tvrl gxaQ-6.swf.lnk", cAlternateFileName="TVRLGX~1.LNK")) returned 0x277e98 [0285.989] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61f30de0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f30de0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f30de0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x12be, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="tvrl gxaQ-6.swf.lnk", cAlternateFileName="TVRLGX~1.LNK")) returned 0 [0285.989] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0285.989] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrl gxaQ-6.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvrl gxaq-6.swf.lnk")) returned 1 [0285.990] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\tvrl gxaQ-6.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvrl gxaq-6.swf.lnk")) returned 0xffffffff [0285.990] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62335300, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62335300, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62335300, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="TvYZ8UN7WJJbdLT2Jnsa.lnk", cAlternateFileName="TVYZ8U~1.LNK")) returned 1 [0285.991] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvYZ8UN7WJJbdLT2Jnsa.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvyz8un7wjjbdlt2jnsa.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0285.991] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvYZ8UN7WJJbdLT2Jnsa.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvyz8un7wjjbdlt2jnsa.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0285.992] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x254 [0285.992] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0285.992] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0286.072] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x254, lpOverlapped=0x0) returned 1 [0286.073] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x260, lpOverlapped=0x0) returned 1 [0286.074] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0286.159] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0286.170] CloseHandle (hObject=0xf8) returned 1 [0286.170] CloseHandle (hObject=0xe0) returned 1 [0286.171] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvYZ8UN7WJJbdLT2Jnsa.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvyz8un7wjjbdlt2jnsa.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvYZ8UN7WJJbdLT2Jnsa.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvyz8un7wjjbdlt2jnsa.lnk.ozq0")) returned 0 [0286.172] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvYZ8UN7WJJbdLT2Jnsa.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvyz8un7wjjbdlt2jnsa.lnk.ozq0")) returned 0x20 [0286.172] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvYZ8UN7WJJbdLT2Jnsa.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62335300, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62335300, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62335300, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="TvYZ8UN7WJJbdLT2Jnsa.lnk", cAlternateFileName="TVYZ8U~1.LNK")) returned 0x277ea8 [0286.172] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62335300, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62335300, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62335300, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="TvYZ8UN7WJJbdLT2Jnsa.lnk", cAlternateFileName="TVYZ8U~1.LNK")) returned 0 [0286.172] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0286.172] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvYZ8UN7WJJbdLT2Jnsa.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvyz8un7wjjbdlt2jnsa.lnk")) returned 1 [0286.173] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TvYZ8UN7WJJbdLT2Jnsa.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\tvyz8un7wjjbdlt2jnsa.lnk")) returned 0xffffffff [0286.173] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a48080, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a48080, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a48080, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1437, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="TxYme7oCRY7z p0YorYd.lnk", cAlternateFileName="TXYME7~1.LNK")) returned 1 [0286.174] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxYme7oCRY7z p0YorYd.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\txyme7ocry7z p0yoryd.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0286.174] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxYme7oCRY7z p0YorYd.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\txyme7ocry7z p0yoryd.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0286.178] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1437 [0286.178] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0286.178] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0286.228] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1437, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1437, lpOverlapped=0x0) returned 1 [0286.229] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1440, lpOverlapped=0x0) returned 1 [0286.230] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0286.291] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0286.302] CloseHandle (hObject=0xe0) returned 1 [0286.302] CloseHandle (hObject=0xf8) returned 1 [0286.302] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxYme7oCRY7z p0YorYd.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\txyme7ocry7z p0yoryd.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxYme7oCRY7z p0YorYd.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\txyme7ocry7z p0yoryd.lnk.ozq0")) returned 0 [0286.303] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxYme7oCRY7z p0YorYd.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\txyme7ocry7z p0yoryd.lnk.ozq0")) returned 0x20 [0286.303] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxYme7oCRY7z p0YorYd.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a48080, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a48080, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a48080, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1437, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="TxYme7oCRY7z p0YorYd.lnk", cAlternateFileName="TXYME7~1.LNK")) returned 0x277ea8 [0286.303] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61a48080, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a48080, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a48080, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1437, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="TxYme7oCRY7z p0YorYd.lnk", cAlternateFileName="TXYME7~1.LNK")) returned 0 [0286.303] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0286.303] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxYme7oCRY7z p0YorYd.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\txyme7ocry7z p0yoryd.lnk")) returned 1 [0286.304] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\TxYme7oCRY7z p0YorYd.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\txyme7ocry7z p0yoryd.lnk")) returned 0xffffffff [0286.304] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e3b120, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e3b120, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e3b120, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x194e, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="T_vY2xPDJ_.lnk", cAlternateFileName="T_VY2X~1.LNK")) returned 1 [0286.305] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T_vY2xPDJ_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t_vy2xpdj_.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0286.305] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T_vY2xPDJ_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t_vy2xpdj_.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0286.306] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x194e [0286.306] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0286.306] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0286.355] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x194e, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x194e, lpOverlapped=0x0) returned 1 [0286.356] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1950, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1950, lpOverlapped=0x0) returned 1 [0286.357] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0286.419] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0286.431] CloseHandle (hObject=0xf8) returned 1 [0286.431] CloseHandle (hObject=0xe0) returned 1 [0286.431] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T_vY2xPDJ_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t_vy2xpdj_.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T_vY2xPDJ_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t_vy2xpdj_.lnk.ozq0")) returned 0 [0286.432] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T_vY2xPDJ_.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t_vy2xpdj_.lnk.ozq0")) returned 0x20 [0286.432] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T_vY2xPDJ_.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e3b120, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e3b120, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e3b120, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x194e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="T_vY2xPDJ_.lnk", cAlternateFileName="T_VY2X~1.LNK")) returned 0x277df0 [0286.432] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60e3b120, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60e3b120, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60e3b120, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x194e, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="T_vY2xPDJ_.lnk", cAlternateFileName="T_VY2X~1.LNK")) returned 0 [0286.432] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0286.432] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T_vY2xPDJ_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t_vy2xpdj_.lnk")) returned 1 [0286.433] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\T_vY2xPDJ_.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\t_vy2xpdj_.lnk")) returned 0xffffffff [0286.433] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e7d8e60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620adba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620adba0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x0, dwReserved1=0x0, cFileName="U-bvd305N1yBxyA.lnk", cAlternateFileName="U-BVD3~1.LNK")) returned 1 [0286.434] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U-bvd305N1yBxyA.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\u-bvd305n1ybxya.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0286.434] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U-bvd305N1yBxyA.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\u-bvd305n1ybxya.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0286.435] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x977 [0286.435] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0286.435] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0286.484] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x977, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x977, lpOverlapped=0x0) returned 1 [0286.485] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x980, lpOverlapped=0x0) returned 1 [0286.486] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0286.562] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0286.573] CloseHandle (hObject=0xe0) returned 1 [0286.573] CloseHandle (hObject=0xf8) returned 1 [0286.574] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U-bvd305N1yBxyA.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\u-bvd305n1ybxya.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U-bvd305N1yBxyA.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\u-bvd305n1ybxya.lnk.ozq0")) returned 0 [0286.575] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U-bvd305N1yBxyA.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\u-bvd305n1ybxya.lnk.ozq0")) returned 0x20 [0286.575] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U-bvd305N1yBxyA.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e7d8e60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620adba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620adba0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="U-bvd305N1yBxyA.lnk", cAlternateFileName="U-BVD3~1.LNK")) returned 0x277e98 [0286.575] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e7d8e60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x620adba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x620adba0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x977, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="U-bvd305N1yBxyA.lnk", cAlternateFileName="U-BVD3~1.LNK")) returned 0 [0286.575] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0286.575] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U-bvd305N1yBxyA.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\u-bvd305n1ybxya.lnk")) returned 1 [0286.576] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\U-bvd305N1yBxyA.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\u-bvd305n1ybxya.lnk")) returned 0xffffffff [0286.576] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61963840, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61963840, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61963840, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="UBdgf3bRfuf-27uIQoFc.lnk", cAlternateFileName="UBDGF3~1.LNK")) returned 1 [0286.577] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBdgf3bRfuf-27uIQoFc.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ubdgf3brfuf-27uiqofc.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0286.577] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBdgf3bRfuf-27uIQoFc.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ubdgf3brfuf-27uiqofc.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0286.578] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x14c2 [0286.578] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0286.578] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0286.630] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x14c2, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x14c2, lpOverlapped=0x0) returned 1 [0286.631] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x14d0, lpOverlapped=0x0) returned 1 [0286.632] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0286.690] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0286.701] CloseHandle (hObject=0xf8) returned 1 [0286.701] CloseHandle (hObject=0xe0) returned 1 [0286.701] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBdgf3bRfuf-27uIQoFc.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ubdgf3brfuf-27uiqofc.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBdgf3bRfuf-27uIQoFc.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ubdgf3brfuf-27uiqofc.lnk.ozq0")) returned 0 [0286.702] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBdgf3bRfuf-27uIQoFc.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ubdgf3brfuf-27uiqofc.lnk.ozq0")) returned 0x20 [0286.702] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBdgf3bRfuf-27uIQoFc.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61963840, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61963840, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61963840, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UBdgf3bRfuf-27uIQoFc.lnk", cAlternateFileName="UBDGF3~1.LNK")) returned 0x277ea8 [0286.702] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61963840, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61963840, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61963840, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UBdgf3bRfuf-27uIQoFc.lnk", cAlternateFileName="UBDGF3~1.LNK")) returned 0 [0286.702] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0286.702] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBdgf3bRfuf-27uIQoFc.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ubdgf3brfuf-27uiqofc.lnk")) returned 1 [0286.703] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UBdgf3bRfuf-27uIQoFc.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ubdgf3brfuf-27uiqofc.lnk")) returned 0xffffffff [0286.703] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f6b97e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e26440, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e26440, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ukKq9PL5UAPJ2VamV.lnk", cAlternateFileName="UKKQ9P~1.LNK")) returned 1 [0286.704] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ukKq9PL5UAPJ2VamV.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ukkq9pl5uapj2vamv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0286.704] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ukKq9PL5UAPJ2VamV.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ukkq9pl5uapj2vamv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0286.706] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe65 [0286.706] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0286.706] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0286.767] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe65, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe65, lpOverlapped=0x0) returned 1 [0286.768] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe70, lpOverlapped=0x0) returned 1 [0286.769] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0286.835] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0286.847] CloseHandle (hObject=0xe0) returned 1 [0286.847] CloseHandle (hObject=0xf8) returned 1 [0286.847] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ukKq9PL5UAPJ2VamV.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ukkq9pl5uapj2vamv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ukKq9PL5UAPJ2VamV.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ukkq9pl5uapj2vamv.lnk.ozq0")) returned 0 [0286.848] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ukKq9PL5UAPJ2VamV.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ukkq9pl5uapj2vamv.lnk.ozq0")) returned 0x20 [0286.848] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ukKq9PL5UAPJ2VamV.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f6b97e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e26440, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e26440, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ukKq9PL5UAPJ2VamV.lnk", cAlternateFileName="UKKQ9P~1.LNK")) returned 0x277ea0 [0286.849] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f6b97e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e26440, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e26440, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ukKq9PL5UAPJ2VamV.lnk", cAlternateFileName="UKKQ9P~1.LNK")) returned 0 [0286.849] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0286.849] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ukKq9PL5UAPJ2VamV.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ukkq9pl5uapj2vamv.lnk")) returned 1 [0286.850] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ukKq9PL5UAPJ2VamV.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ukkq9pl5uapj2vamv.lnk")) returned 0xffffffff [0286.850] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60da2ba0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60da2ba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60dc8d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd63, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="UML0ICY.swf.lnk", cAlternateFileName="UML0IC~1.LNK")) returned 1 [0286.850] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UML0ICY.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\uml0icy.swf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0286.850] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UML0ICY.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\uml0icy.swf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0286.851] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd63 [0286.851] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0286.852] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0286.900] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd63, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd63, lpOverlapped=0x0) returned 1 [0286.900] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd70, lpOverlapped=0x0) returned 1 [0286.901] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0286.968] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0286.979] CloseHandle (hObject=0xf8) returned 1 [0286.979] CloseHandle (hObject=0xe0) returned 1 [0286.979] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UML0ICY.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\uml0icy.swf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UML0ICY.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\uml0icy.swf.lnk.ozq0")) returned 0 [0286.980] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UML0ICY.swf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\uml0icy.swf.lnk.ozq0")) returned 0x20 [0286.980] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UML0ICY.swf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60da2ba0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60da2ba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60dc8d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd63, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UML0ICY.swf.lnk", cAlternateFileName="UML0IC~1.LNK")) returned 0x277df0 [0286.980] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60da2ba0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x60da2ba0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x60dc8d00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd63, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="UML0ICY.swf.lnk", cAlternateFileName="UML0IC~1.LNK")) returned 0 [0286.980] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0286.980] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UML0ICY.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\uml0icy.swf.lnk")) returned 1 [0286.981] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\UML0ICY.swf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\uml0icy.swf.lnk")) returned 0xffffffff [0286.981] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e4c5a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e4c5a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e4c5a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Up37ON.lnk", cAlternateFileName="")) returned 1 [0286.982] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Up37ON.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\up37on.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0286.982] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Up37ON.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\up37on.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0286.983] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xea1 [0286.983] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0286.984] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0287.032] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xea1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xea1, lpOverlapped=0x0) returned 1 [0287.032] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xeb0, lpOverlapped=0x0) returned 1 [0287.033] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0287.096] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0287.108] CloseHandle (hObject=0xe0) returned 1 [0287.108] CloseHandle (hObject=0xf8) returned 1 [0287.108] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Up37ON.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\up37on.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Up37ON.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\up37on.lnk.ozq0")) returned 0 [0287.109] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Up37ON.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\up37on.lnk.ozq0")) returned 0x20 [0287.109] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Up37ON.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e4c5a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e4c5a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e4c5a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Up37ON.lnk", cAlternateFileName="")) returned 0x277e88 [0287.109] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e4c5a0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e4c5a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e4c5a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xea1, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Up37ON.lnk", cAlternateFileName="")) returned 0 [0287.109] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0287.109] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Up37ON.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\up37on.lnk")) returned 1 [0287.110] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Up37ON.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\up37on.lnk")) returned 0xffffffff [0287.110] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda180, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61dda180, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e002e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="v-LN1eKriY4kdjDq.flv.lnk", cAlternateFileName="V-LN1E~1.LNK")) returned 1 [0287.110] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v-LN1eKriY4kdjDq.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v-ln1ekriy4kdjdq.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0287.118] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v-LN1eKriY4kdjDq.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v-ln1ekriy4kdjdq.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0287.119] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9a1 [0287.119] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0287.119] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0287.207] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9a1, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9a1, lpOverlapped=0x0) returned 1 [0287.208] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9b0, lpOverlapped=0x0) returned 1 [0287.209] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0287.270] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0287.282] CloseHandle (hObject=0xf8) returned 1 [0287.282] CloseHandle (hObject=0xe0) returned 1 [0287.282] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v-LN1eKriY4kdjDq.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v-ln1ekriy4kdjdq.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v-LN1eKriY4kdjDq.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v-ln1ekriy4kdjdq.flv.lnk.ozq0")) returned 0 [0287.284] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v-LN1eKriY4kdjDq.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v-ln1ekriy4kdjdq.flv.lnk.ozq0")) returned 0x20 [0287.284] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v-LN1eKriY4kdjDq.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda180, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61dda180, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e002e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="v-LN1eKriY4kdjDq.flv.lnk", cAlternateFileName="V-LN1E~1.LNK")) returned 0x277ea8 [0287.284] FindNextFileA (in: hFindFile=0x277ea8, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61dda180, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61dda180, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e002e0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9a1, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="v-LN1eKriY4kdjDq.flv.lnk", cAlternateFileName="V-LN1E~1.LNK")) returned 0 [0287.284] FindClose (in: hFindFile=0x277ea8 | out: hFindFile=0x277ea8) returned 1 [0287.284] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v-LN1eKriY4kdjDq.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v-ln1ekriy4kdjdq.flv.lnk")) returned 1 [0287.285] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\v-LN1eKriY4kdjDq.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v-ln1ekriy4kdjdq.flv.lnk")) returned 0xffffffff [0287.285] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60149980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a21f20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a21f20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd1c, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="V8zaFqIq.lnk", cAlternateFileName="")) returned 1 [0287.286] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8zaFqIq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v8zafqiq.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0287.286] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8zaFqIq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v8zafqiq.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0287.287] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd1c [0287.287] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0287.288] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0287.388] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd1c, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd1c, lpOverlapped=0x0) returned 1 [0287.389] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd20, lpOverlapped=0x0) returned 1 [0287.390] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0287.452] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0287.463] CloseHandle (hObject=0xe0) returned 1 [0287.463] CloseHandle (hObject=0xf8) returned 1 [0287.463] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8zaFqIq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v8zafqiq.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8zaFqIq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v8zafqiq.lnk.ozq0")) returned 0 [0287.464] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8zaFqIq.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v8zafqiq.lnk.ozq0")) returned 0x20 [0287.464] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8zaFqIq.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60149980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a21f20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a21f20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd1c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="V8zaFqIq.lnk", cAlternateFileName="")) returned 0x277df0 [0287.464] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60149980, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61a21f20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61a21f20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd1c, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="V8zaFqIq.lnk", cAlternateFileName="")) returned 0 [0287.464] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0287.464] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8zaFqIq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v8zafqiq.lnk")) returned 1 [0287.465] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\V8zaFqIq.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\v8zafqiq.lnk")) returned 0xffffffff [0287.465] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619fbdc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619fbdc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619fbdc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="VoKWqfP27uPiJP9n.lnk", cAlternateFileName="VOKWQF~1.LNK")) returned 1 [0287.466] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VoKWqfP27uPiJP9n.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vokwqfp27upijp9n.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0287.466] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VoKWqfP27uPiJP9n.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vokwqfp27upijp9n.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0287.467] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xa00 [0287.467] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0287.467] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0287.558] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xa00, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xa00, lpOverlapped=0x0) returned 1 [0287.559] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xa10, lpOverlapped=0x0) returned 1 [0287.560] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0287.624] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0287.635] CloseHandle (hObject=0xf8) returned 1 [0287.635] CloseHandle (hObject=0xe0) returned 1 [0287.635] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VoKWqfP27uPiJP9n.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vokwqfp27upijp9n.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VoKWqfP27uPiJP9n.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vokwqfp27upijp9n.lnk.ozq0")) returned 0 [0287.636] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VoKWqfP27uPiJP9n.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vokwqfp27upijp9n.lnk.ozq0")) returned 0x20 [0287.636] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VoKWqfP27uPiJP9n.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619fbdc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619fbdc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619fbdc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="VoKWqfP27uPiJP9n.lnk", cAlternateFileName="VOKWQF~1.LNK")) returned 0x277ea0 [0287.637] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x619fbdc0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x619fbdc0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x619fbdc0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="VoKWqfP27uPiJP9n.lnk", cAlternateFileName="VOKWQF~1.LNK")) returned 0 [0287.637] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0287.637] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VoKWqfP27uPiJP9n.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vokwqfp27upijp9n.lnk")) returned 1 [0287.638] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\VoKWqfP27uPiJP9n.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vokwqfp27upijp9n.lnk")) returned 0xffffffff [0287.638] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614ecf00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614ecf00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614ecf00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Vp4fJ yoWpRb.lnk", cAlternateFileName="VP4FJY~1.LNK")) returned 1 [0287.638] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vp4fJ yoWpRb.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vp4fj yowprb.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0287.638] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vp4fJ yoWpRb.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vp4fj yowprb.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0287.639] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x37a [0287.639] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0287.640] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0287.754] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x37a, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x37a, lpOverlapped=0x0) returned 1 [0287.755] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x380, lpOverlapped=0x0) returned 1 [0287.756] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0287.815] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0287.826] CloseHandle (hObject=0xe0) returned 1 [0287.826] CloseHandle (hObject=0xf8) returned 1 [0287.827] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vp4fJ yoWpRb.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vp4fj yowprb.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vp4fJ yoWpRb.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vp4fj yowprb.lnk.ozq0")) returned 0 [0287.828] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vp4fJ yoWpRb.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vp4fj yowprb.lnk.ozq0")) returned 0x20 [0287.828] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vp4fJ yoWpRb.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614ecf00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614ecf00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614ecf00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Vp4fJ yoWpRb.lnk", cAlternateFileName="VP4FJY~1.LNK")) returned 0x277e98 [0287.828] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614ecf00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614ecf00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614ecf00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x37a, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="Vp4fJ yoWpRb.lnk", cAlternateFileName="VP4FJY~1.LNK")) returned 0 [0287.828] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0287.828] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vp4fJ yoWpRb.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vp4fj yowprb.lnk")) returned 1 [0287.829] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Vp4fJ yoWpRb.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vp4fj yowprb.lnk")) returned 0xffffffff [0287.829] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ec29640, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6230f1a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6230f1a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd3b, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="vSPR4.lnk", cAlternateFileName="")) returned 1 [0287.830] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vSPR4.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vspr4.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0287.830] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vSPR4.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vspr4.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0287.831] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd3b [0287.831] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0287.831] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0287.922] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd3b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd3b, lpOverlapped=0x0) returned 1 [0287.923] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd40, lpOverlapped=0x0) returned 1 [0287.924] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0287.983] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0287.995] CloseHandle (hObject=0xf8) returned 1 [0287.995] CloseHandle (hObject=0xe0) returned 1 [0287.995] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vSPR4.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vspr4.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vSPR4.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vspr4.lnk.ozq0")) returned 0 [0287.996] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vSPR4.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vspr4.lnk.ozq0")) returned 0x20 [0287.996] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vSPR4.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ec29640, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6230f1a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6230f1a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd3b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="vSPR4.lnk", cAlternateFileName="")) returned 0x277e88 [0287.996] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ec29640, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6230f1a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6230f1a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd3b, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="vSPR4.lnk", cAlternateFileName="")) returned 0 [0287.996] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0287.996] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vSPR4.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vspr4.lnk")) returned 1 [0287.997] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vSPR4.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vspr4.lnk")) returned 0xffffffff [0287.997] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6187f000, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6187f000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6187f000, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1230, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="vtSc.mkv.lnk", cAlternateFileName="VTSCMK~1.LNK")) returned 1 [0287.997] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vtSc.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vtsc.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0287.998] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vtSc.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vtsc.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0287.999] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1230 [0287.999] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0287.999] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0288.088] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1230, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1230, lpOverlapped=0x0) returned 1 [0288.089] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1240, lpOverlapped=0x0) returned 1 [0288.090] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0288.155] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0288.166] CloseHandle (hObject=0xe0) returned 1 [0288.166] CloseHandle (hObject=0xf8) returned 1 [0288.167] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vtSc.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vtsc.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vtSc.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vtsc.mkv.lnk.ozq0")) returned 0 [0288.168] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vtSc.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vtsc.mkv.lnk.ozq0")) returned 0x20 [0288.168] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vtSc.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6187f000, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6187f000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6187f000, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1230, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="vtSc.mkv.lnk", cAlternateFileName="VTSCMK~1.LNK")) returned 0x277df0 [0288.168] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6187f000, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6187f000, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6187f000, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1230, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="vtSc.mkv.lnk", cAlternateFileName="VTSCMK~1.LNK")) returned 0 [0288.168] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0288.168] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vtSc.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vtsc.mkv.lnk")) returned 1 [0288.169] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\vtSc.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\vtsc.mkv.lnk")) returned 0xffffffff [0288.169] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62276c20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62276c20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62276c20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="w95s -vBRKrhsm8EJlYo.flv.lnk", cAlternateFileName="W95S-V~1.LNK")) returned 1 [0288.169] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s -vBRKrhsm8EJlYo.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\w95s -vbrkrhsm8ejlyo.flv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0288.170] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s -vBRKrhsm8EJlYo.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\w95s -vbrkrhsm8ejlyo.flv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0288.171] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3ed [0288.171] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0288.171] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0288.260] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3ed, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3ed, lpOverlapped=0x0) returned 1 [0288.260] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3f0, lpOverlapped=0x0) returned 1 [0288.261] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0288.320] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0288.331] CloseHandle (hObject=0xf8) returned 1 [0288.331] CloseHandle (hObject=0xe0) returned 1 [0288.331] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s -vBRKrhsm8EJlYo.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\w95s -vbrkrhsm8ejlyo.flv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s -vBRKrhsm8EJlYo.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\w95s -vbrkrhsm8ejlyo.flv.lnk.ozq0")) returned 0 [0288.332] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s -vBRKrhsm8EJlYo.flv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\w95s -vbrkrhsm8ejlyo.flv.lnk.ozq0")) returned 0x20 [0288.332] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s -vBRKrhsm8EJlYo.flv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62276c20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62276c20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62276c20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="w95s -vBRKrhsm8EJlYo.flv.lnk", cAlternateFileName="W95S-V~1.LNK")) returned 0x277eb0 [0288.332] FindNextFileA (in: hFindFile=0x277eb0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62276c20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62276c20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62276c20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3ed, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="w95s -vBRKrhsm8EJlYo.flv.lnk", cAlternateFileName="W95S-V~1.LNK")) returned 0 [0288.332] FindClose (in: hFindFile=0x277eb0 | out: hFindFile=0x277eb0) returned 1 [0288.333] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s -vBRKrhsm8EJlYo.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\w95s -vbrkrhsm8ejlyo.flv.lnk")) returned 1 [0288.334] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\w95s -vBRKrhsm8EJlYo.flv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\w95s -vbrkrhsm8ejlyo.flv.lnk")) returned 0xffffffff [0288.334] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c37260, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c37260, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c37260, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1446, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="wF2KYntEO.pdf.lnk", cAlternateFileName="WF2KYN~1.LNK")) returned 1 [0288.334] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wF2KYntEO.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wf2kynteo.pdf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0288.334] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wF2KYntEO.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wf2kynteo.pdf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0288.336] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1446 [0288.336] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0288.336] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0288.427] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1446, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1446, lpOverlapped=0x0) returned 1 [0288.428] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1450, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1450, lpOverlapped=0x0) returned 1 [0288.429] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0288.495] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0288.506] CloseHandle (hObject=0xe0) returned 1 [0288.506] CloseHandle (hObject=0xf8) returned 1 [0288.506] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wF2KYntEO.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wf2kynteo.pdf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wF2KYntEO.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wf2kynteo.pdf.lnk.ozq0")) returned 0 [0288.507] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wF2KYntEO.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wf2kynteo.pdf.lnk.ozq0")) returned 0x20 [0288.507] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wF2KYntEO.pdf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c37260, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c37260, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c37260, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1446, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="wF2KYntEO.pdf.lnk", cAlternateFileName="WF2KYN~1.LNK")) returned 0x277e98 [0288.507] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c37260, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61c37260, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61c37260, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1446, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="wF2KYntEO.pdf.lnk", cAlternateFileName="WF2KYN~1.LNK")) returned 0 [0288.507] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0288.507] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wF2KYntEO.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wf2kynteo.pdf.lnk")) returned 1 [0288.508] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wF2KYntEO.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wf2kynteo.pdf.lnk")) returned 0xffffffff [0288.508] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d67d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d67d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WkT-r R-fhRzP8gjvJ.lnk", cAlternateFileName="WKT-RR~1.LNK")) returned 1 [0288.509] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkT-r R-fhRzP8gjvJ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wkt-r r-fhrzp8gjvj.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0288.509] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkT-r R-fhRzP8gjvJ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wkt-r r-fhrzp8gjvj.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0288.510] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x191f [0288.510] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0288.510] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0288.598] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x191f, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x191f, lpOverlapped=0x0) returned 1 [0288.599] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1920, lpOverlapped=0x0) returned 1 [0288.600] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0288.664] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0288.675] CloseHandle (hObject=0xf8) returned 1 [0288.675] CloseHandle (hObject=0xe0) returned 1 [0288.675] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkT-r R-fhRzP8gjvJ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wkt-r r-fhrzp8gjvj.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkT-r R-fhRzP8gjvJ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wkt-r r-fhrzp8gjvj.lnk.ozq0")) returned 0 [0288.676] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkT-r R-fhRzP8gjvJ.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wkt-r r-fhrzp8gjvj.lnk.ozq0")) returned 0x20 [0288.676] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkT-r R-fhRzP8gjvJ.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d67d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d67d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WkT-r R-fhRzP8gjvJ.lnk", cAlternateFileName="WKT-RR~1.LNK")) returned 0x277ea0 [0288.676] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d67d60, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61d67d60, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61d67d60, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="WkT-r R-fhRzP8gjvJ.lnk", cAlternateFileName="WKT-RR~1.LNK")) returned 0 [0288.676] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0288.676] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkT-r R-fhRzP8gjvJ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wkt-r r-fhrzp8gjvj.lnk")) returned 1 [0288.677] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WkT-r R-fhRzP8gjvJ.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wkt-r r-fhrzp8gjvj.lnk")) returned 0xffffffff [0288.677] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6243fca0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6243fca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6243fca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd7d, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="WsRnv6mAo.mkv.lnk", cAlternateFileName="WSRNV6~1.LNK")) returned 1 [0288.678] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WsRnv6mAo.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wsrnv6mao.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0288.678] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WsRnv6mAo.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wsrnv6mao.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0288.679] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd7d [0288.679] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0288.679] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0288.778] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd7d, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd7d, lpOverlapped=0x0) returned 1 [0288.779] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd80, lpOverlapped=0x0) returned 1 [0288.780] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0288.841] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0288.852] CloseHandle (hObject=0xe0) returned 1 [0288.852] CloseHandle (hObject=0xf8) returned 1 [0288.852] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WsRnv6mAo.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wsrnv6mao.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WsRnv6mAo.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wsrnv6mao.mkv.lnk.ozq0")) returned 0 [0288.853] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WsRnv6mAo.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wsrnv6mao.mkv.lnk.ozq0")) returned 0x20 [0288.853] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WsRnv6mAo.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6243fca0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6243fca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6243fca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd7d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="WsRnv6mAo.mkv.lnk", cAlternateFileName="WSRNV6~1.LNK")) returned 0x277e98 [0288.853] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6243fca0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6243fca0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6243fca0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd7d, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="WsRnv6mAo.mkv.lnk", cAlternateFileName="WSRNV6~1.LNK")) returned 0 [0288.853] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0288.853] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WsRnv6mAo.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wsrnv6mao.mkv.lnk")) returned 1 [0288.854] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\WsRnv6mAo.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wsrnv6mao.mkv.lnk")) returned 0xffffffff [0288.854] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x623cd880, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623cd880, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623cd880, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="wZkBlw.lnk", cAlternateFileName="")) returned 1 [0288.855] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZkBlw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wzkblw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0288.855] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZkBlw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wzkblw.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0288.856] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1894 [0288.856] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0288.856] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0288.945] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1894, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1894, lpOverlapped=0x0) returned 1 [0288.946] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x18a0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x18a0, lpOverlapped=0x0) returned 1 [0288.947] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0289.009] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0289.020] CloseHandle (hObject=0xf8) returned 1 [0289.020] CloseHandle (hObject=0xe0) returned 1 [0289.020] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZkBlw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wzkblw.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZkBlw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wzkblw.lnk.ozq0")) returned 0 [0289.021] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZkBlw.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wzkblw.lnk.ozq0")) returned 0x20 [0289.021] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZkBlw.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x623cd880, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623cd880, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623cd880, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="wZkBlw.lnk", cAlternateFileName="")) returned 0x277e88 [0289.021] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x623cd880, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623cd880, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623cd880, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="wZkBlw.lnk", cAlternateFileName="")) returned 0 [0289.021] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0289.022] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZkBlw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wzkblw.lnk")) returned 1 [0289.023] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\wZkBlw.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\wzkblw.lnk")) returned 0xffffffff [0289.023] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6216c280, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6216c280, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6216c280, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x18fb, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="xbPK3rmy04D5L6E.pdf.lnk", cAlternateFileName="XBPK3R~1.LNK")) returned 1 [0289.023] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbPK3rmy04D5L6E.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xbpk3rmy04d5l6e.pdf.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0289.023] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbPK3rmy04D5L6E.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xbpk3rmy04d5l6e.pdf.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0289.024] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x18fb [0289.024] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0289.025] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0289.115] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x18fb, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x18fb, lpOverlapped=0x0) returned 1 [0289.116] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1900, lpOverlapped=0x0) returned 1 [0289.117] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0289.187] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0289.198] CloseHandle (hObject=0xe0) returned 1 [0289.198] CloseHandle (hObject=0xf8) returned 1 [0289.198] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbPK3rmy04D5L6E.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xbpk3rmy04d5l6e.pdf.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbPK3rmy04D5L6E.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xbpk3rmy04d5l6e.pdf.lnk.ozq0")) returned 0 [0289.199] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbPK3rmy04D5L6E.pdf.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xbpk3rmy04d5l6e.pdf.lnk.ozq0")) returned 0x20 [0289.199] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbPK3rmy04D5L6E.pdf.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6216c280, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6216c280, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6216c280, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x18fb, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="xbPK3rmy04D5L6E.pdf.lnk", cAlternateFileName="XBPK3R~1.LNK")) returned 0x277ea0 [0289.199] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6216c280, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6216c280, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6216c280, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x18fb, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="xbPK3rmy04D5L6E.pdf.lnk", cAlternateFileName="XBPK3R~1.LNK")) returned 0 [0289.199] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0289.199] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbPK3rmy04D5L6E.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xbpk3rmy04d5l6e.pdf.lnk")) returned 1 [0289.200] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xbPK3rmy04D5L6E.pdf.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xbpk3rmy04d5l6e.pdf.lnk")) returned 0xffffffff [0289.200] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cf5940, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61cf5940, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61cf5940, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="xdtwIKohXFD2.lnk", cAlternateFileName="XDTWIK~1.LNK")) returned 1 [0289.201] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdtwIKohXFD2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xdtwikohxfd2.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0289.201] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdtwIKohXFD2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xdtwikohxfd2.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0289.202] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x3c5 [0289.202] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0289.202] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0289.292] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x3c5, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x3c5, lpOverlapped=0x0) returned 1 [0289.293] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x3d0, lpOverlapped=0x0) returned 1 [0289.294] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0289.356] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0289.368] CloseHandle (hObject=0xf8) returned 1 [0289.368] CloseHandle (hObject=0xe0) returned 1 [0289.368] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdtwIKohXFD2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xdtwikohxfd2.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdtwIKohXFD2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xdtwikohxfd2.lnk.ozq0")) returned 0 [0289.369] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdtwIKohXFD2.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xdtwikohxfd2.lnk.ozq0")) returned 0x20 [0289.369] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdtwIKohXFD2.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cf5940, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61cf5940, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61cf5940, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="xdtwIKohXFD2.lnk", cAlternateFileName="XDTWIK~1.LNK")) returned 0x277e98 [0289.369] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61cf5940, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61cf5940, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61cf5940, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="xdtwIKohXFD2.lnk", cAlternateFileName="XDTWIK~1.LNK")) returned 0 [0289.369] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0289.369] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdtwIKohXFD2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xdtwikohxfd2.lnk")) returned 1 [0289.370] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xdtwIKohXFD2.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xdtwikohxfd2.lnk")) returned 0xffffffff [0289.370] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3276e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b78b80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xddd, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="xnge9.lnk", cAlternateFileName="")) returned 1 [0289.371] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnge9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xnge9.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0289.371] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnge9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xnge9.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0289.372] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xddd [0289.372] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0289.372] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0289.463] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xddd, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xddd, lpOverlapped=0x0) returned 1 [0289.465] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xde0, lpOverlapped=0x0) returned 1 [0289.466] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0289.531] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0289.543] CloseHandle (hObject=0xe0) returned 1 [0289.543] CloseHandle (hObject=0xf8) returned 1 [0289.543] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnge9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xnge9.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnge9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xnge9.lnk.ozq0")) returned 0 [0289.544] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnge9.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xnge9.lnk.ozq0")) returned 0x20 [0289.544] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnge9.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3276e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b78b80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xddd, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="xnge9.lnk", cAlternateFileName="")) returned 0x277e88 [0289.544] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f3276e0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b52a20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b78b80, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xddd, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="xnge9.lnk", cAlternateFileName="")) returned 0 [0289.544] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0289.544] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnge9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xnge9.lnk")) returned 1 [0289.545] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xnge9.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xnge9.lnk")) returned 0xffffffff [0289.545] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6180cbe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6180cbe0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6180cbe0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="xszpx.mkv.lnk", cAlternateFileName="XSZPXM~1.LNK")) returned 1 [0289.546] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xszpx.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xszpx.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0289.546] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xszpx.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xszpx.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0289.547] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1750 [0289.547] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0289.547] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0289.639] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1750, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1750, lpOverlapped=0x0) returned 1 [0289.640] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1760, lpOverlapped=0x0) returned 1 [0289.641] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0289.702] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0289.713] CloseHandle (hObject=0xf8) returned 1 [0289.713] CloseHandle (hObject=0xe0) returned 1 [0289.713] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xszpx.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xszpx.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xszpx.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xszpx.mkv.lnk.ozq0")) returned 0 [0289.714] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xszpx.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xszpx.mkv.lnk.ozq0")) returned 0x20 [0289.714] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xszpx.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6180cbe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6180cbe0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6180cbe0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="xszpx.mkv.lnk", cAlternateFileName="XSZPXM~1.LNK")) returned 0x277df0 [0289.714] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6180cbe0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x6180cbe0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x6180cbe0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="xszpx.mkv.lnk", cAlternateFileName="XSZPXM~1.LNK")) returned 0 [0289.714] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0289.714] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xszpx.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xszpx.mkv.lnk")) returned 1 [0289.715] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\xszpx.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\xszpx.mkv.lnk")) returned 0xffffffff [0289.716] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611cd220, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x611cd220, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x611cd220, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xed7, dwReserved0=0x0, dwReserved1=0x0, cFileName="yCFFEuMwxjE8px2.mkv.lnk", cAlternateFileName="YCFFEU~1.LNK")) returned 1 [0289.717] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yCFFEuMwxjE8px2.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ycffeumwxje8px2.mkv.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0289.717] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yCFFEuMwxjE8px2.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ycffeumwxje8px2.mkv.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0289.728] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xed7 [0289.728] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0289.729] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0289.823] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xed7, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xed7, lpOverlapped=0x0) returned 1 [0289.823] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xee0, lpOverlapped=0x0) returned 1 [0289.824] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0289.895] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0289.906] CloseHandle (hObject=0xe0) returned 1 [0289.906] CloseHandle (hObject=0xf8) returned 1 [0289.906] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yCFFEuMwxjE8px2.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ycffeumwxje8px2.mkv.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yCFFEuMwxjE8px2.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ycffeumwxje8px2.mkv.lnk.ozq0")) returned 0 [0289.907] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yCFFEuMwxjE8px2.mkv.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ycffeumwxje8px2.mkv.lnk.ozq0")) returned 0x20 [0289.907] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yCFFEuMwxjE8px2.mkv.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611cd220, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x611cd220, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x611cd220, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xed7, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="yCFFEuMwxjE8px2.mkv.lnk", cAlternateFileName="YCFFEU~1.LNK")) returned 0x277ea0 [0289.907] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x611cd220, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x611cd220, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x611cd220, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xed7, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="yCFFEuMwxjE8px2.mkv.lnk", cAlternateFileName="YCFFEU~1.LNK")) returned 0 [0289.908] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0289.908] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yCFFEuMwxjE8px2.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ycffeumwxje8px2.mkv.lnk")) returned 1 [0289.909] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yCFFEuMwxjE8px2.mkv.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ycffeumwxje8px2.mkv.lnk")) returned 0xffffffff [0289.909] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e26440, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e26440, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e26440, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1480, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="yp14GMfqrdPyU7i.lnk", cAlternateFileName="YP14GM~1.LNK")) returned 1 [0289.909] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yp14GMfqrdPyU7i.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\yp14gmfqrdpyu7i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0289.909] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yp14GMfqrdPyU7i.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\yp14gmfqrdpyu7i.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0289.911] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1480 [0289.911] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0289.911] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0290.009] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1480, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1480, lpOverlapped=0x0) returned 1 [0290.009] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1490, lpOverlapped=0x0) returned 1 [0290.010] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0290.072] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0290.084] CloseHandle (hObject=0xf8) returned 1 [0290.084] CloseHandle (hObject=0xe0) returned 1 [0290.084] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yp14GMfqrdPyU7i.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\yp14gmfqrdpyu7i.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yp14GMfqrdPyU7i.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\yp14gmfqrdpyu7i.lnk.ozq0")) returned 0 [0290.085] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yp14GMfqrdPyU7i.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\yp14gmfqrdpyu7i.lnk.ozq0")) returned 0x20 [0290.085] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yp14GMfqrdPyU7i.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e26440, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e26440, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e26440, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1480, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="yp14GMfqrdPyU7i.lnk", cAlternateFileName="YP14GM~1.LNK")) returned 0x277e98 [0290.085] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e26440, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e26440, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e26440, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1480, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="yp14GMfqrdPyU7i.lnk", cAlternateFileName="YP14GM~1.LNK")) returned 0 [0290.085] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0290.085] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yp14GMfqrdPyU7i.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\yp14gmfqrdpyu7i.lnk")) returned 1 [0290.086] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\yp14GMfqrdPyU7i.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\yp14gmfqrdpyu7i.lnk")) returned 0xffffffff [0290.086] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e72700, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e72700, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e72700, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ysx9v.lnk", cAlternateFileName="")) returned 1 [0290.087] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ysx9v.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ysx9v.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0290.087] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ysx9v.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ysx9v.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0290.088] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x205 [0290.088] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0290.088] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0290.179] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x205, lpOverlapped=0x0) returned 1 [0290.179] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x210, lpOverlapped=0x0) returned 1 [0290.180] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0290.249] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0290.260] CloseHandle (hObject=0xe0) returned 1 [0290.260] CloseHandle (hObject=0xf8) returned 1 [0290.261] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ysx9v.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ysx9v.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ysx9v.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ysx9v.lnk.ozq0")) returned 0 [0290.261] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ysx9v.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ysx9v.lnk.ozq0")) returned 0x20 [0290.261] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ysx9v.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e72700, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e72700, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e72700, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ysx9v.lnk", cAlternateFileName="")) returned 0x277e88 [0290.262] FindNextFileA (in: hFindFile=0x277e88, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61e72700, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61e72700, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61e72700, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ysx9v.lnk", cAlternateFileName="")) returned 0 [0290.262] FindClose (in: hFindFile=0x277e88 | out: hFindFile=0x277e88) returned 1 [0290.262] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ysx9v.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ysx9v.lnk")) returned 1 [0290.263] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ysx9v.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ysx9v.lnk")) returned 0xffffffff [0290.263] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1e5760, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f7d0a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f7d0a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="y_dG6d658.lnk", cAlternateFileName="Y_DG6D~1.LNK")) returned 1 [0290.263] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_dG6d658.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_dg6d658.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0290.264] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_dG6d658.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_dg6d658.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0290.265] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x11da [0290.265] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0290.265] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0290.353] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x11da, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x11da, lpOverlapped=0x0) returned 1 [0290.354] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x11e0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x11e0, lpOverlapped=0x0) returned 1 [0290.355] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0290.414] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0290.425] CloseHandle (hObject=0xf8) returned 1 [0290.425] CloseHandle (hObject=0xe0) returned 1 [0290.425] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_dG6d658.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_dg6d658.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_dG6d658.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_dg6d658.lnk.ozq0")) returned 0 [0290.426] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_dG6d658.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_dg6d658.lnk.ozq0")) returned 0x20 [0290.426] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_dG6d658.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1e5760, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f7d0a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f7d0a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="y_dG6d658.lnk", cAlternateFileName="Y_DG6D~1.LNK")) returned 0x277df0 [0290.426] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1e5760, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61f7d0a0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61f7d0a0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="y_dG6d658.lnk", cAlternateFileName="Y_DG6D~1.LNK")) returned 0 [0290.426] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0290.426] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_dG6d658.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_dg6d658.lnk")) returned 1 [0290.427] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_dG6d658.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_dg6d658.lnk")) returned 0xffffffff [0290.427] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614ecf00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614ecf00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614ecf00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="y_V_y2cTxpIDIX.lnk", cAlternateFileName="Y_V_Y2~1.LNK")) returned 1 [0290.428] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_V_y2cTxpIDIX.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_v_y2ctxpidix.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0290.428] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_V_y2cTxpIDIX.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_v_y2ctxpidix.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0290.429] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ce [0290.429] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0290.429] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0290.517] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9ce, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9ce, lpOverlapped=0x0) returned 1 [0290.518] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9d0, lpOverlapped=0x0) returned 1 [0290.519] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0290.590] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0290.601] CloseHandle (hObject=0xe0) returned 1 [0290.601] CloseHandle (hObject=0xf8) returned 1 [0290.601] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_V_y2cTxpIDIX.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_v_y2ctxpidix.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_V_y2cTxpIDIX.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_v_y2ctxpidix.lnk.ozq0")) returned 0 [0290.602] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_V_y2cTxpIDIX.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_v_y2ctxpidix.lnk.ozq0")) returned 0x20 [0290.602] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_V_y2cTxpIDIX.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614ecf00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614ecf00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614ecf00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ce, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="y_V_y2cTxpIDIX.lnk", cAlternateFileName="Y_V_Y2~1.LNK")) returned 0x277e98 [0290.603] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x614ecf00, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x614ecf00, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x614ecf00, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ce, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="y_V_y2cTxpIDIX.lnk", cAlternateFileName="Y_V_Y2~1.LNK")) returned 0 [0290.603] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0290.603] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_V_y2cTxpIDIX.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_v_y2ctxpidix.lnk")) returned 1 [0290.604] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\y_V_y2cTxpIDIX.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\y_v_y2ctxpidix.lnk")) returned 0xffffffff [0290.604] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ebe9c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ebe9c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ebe9c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="Z3SeozR.ots.lnk", cAlternateFileName="Z3SEOZ~1.LNK")) returned 1 [0290.604] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z3SeozR.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\z3seozr.ots.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0290.604] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z3SeozR.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\z3seozr.ots.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0290.605] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x13a9 [0290.605] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0290.606] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0290.695] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x13a9, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x13a9, lpOverlapped=0x0) returned 1 [0290.695] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x13b0, lpOverlapped=0x0) returned 1 [0290.697] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0290.756] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0290.767] CloseHandle (hObject=0xf8) returned 1 [0290.767] CloseHandle (hObject=0xe0) returned 1 [0290.767] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z3SeozR.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\z3seozr.ots.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z3SeozR.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\z3seozr.ots.lnk.ozq0")) returned 0 [0290.768] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z3SeozR.ots.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\z3seozr.ots.lnk.ozq0")) returned 0x20 [0290.768] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z3SeozR.ots.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ebe9c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ebe9c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ebe9c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Z3SeozR.ots.lnk", cAlternateFileName="Z3SEOZ~1.LNK")) returned 0x277df0 [0290.768] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61ebe9c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61ebe9c0, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61ebe9c0, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x13a9, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="Z3SeozR.ots.lnk", cAlternateFileName="Z3SEOZ~1.LNK")) returned 0 [0290.768] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0290.768] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z3SeozR.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\z3seozr.ots.lnk")) returned 1 [0290.769] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\Z3SeozR.ots.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\z3seozr.ots.lnk")) returned 0xffffffff [0290.769] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b06760, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b06760, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b06760, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1474, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZdPEloNUqMk9Fol2tAW.lnk", cAlternateFileName="ZDPELO~1.LNK")) returned 1 [0290.770] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZdPEloNUqMk9Fol2tAW.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zdpelonuqmk9fol2taw.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0290.770] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZdPEloNUqMk9Fol2tAW.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zdpelonuqmk9fol2taw.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0290.771] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x1474 [0290.771] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0290.771] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0290.864] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x1474, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x1474, lpOverlapped=0x0) returned 1 [0290.865] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x1480, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x1480, lpOverlapped=0x0) returned 1 [0290.866] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0290.928] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0290.940] CloseHandle (hObject=0xe0) returned 1 [0290.940] CloseHandle (hObject=0xf8) returned 1 [0290.940] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZdPEloNUqMk9Fol2tAW.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zdpelonuqmk9fol2taw.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZdPEloNUqMk9Fol2tAW.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zdpelonuqmk9fol2taw.lnk.ozq0")) returned 0 [0290.941] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZdPEloNUqMk9Fol2tAW.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zdpelonuqmk9fol2taw.lnk.ozq0")) returned 0x20 [0290.941] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZdPEloNUqMk9Fol2tAW.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b06760, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b06760, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b06760, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1474, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ZdPEloNUqMk9Fol2tAW.lnk", cAlternateFileName="ZDPELO~1.LNK")) returned 0x277ea0 [0290.941] FindNextFileA (in: hFindFile=0x277ea0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61b06760, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x61b06760, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x61b06760, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x1474, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ZdPEloNUqMk9Fol2tAW.lnk", cAlternateFileName="ZDPELO~1.LNK")) returned 0 [0290.941] FindClose (in: hFindFile=0x277ea0 | out: hFindFile=0x277ea0) returned 1 [0290.941] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZdPEloNUqMk9Fol2tAW.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zdpelonuqmk9fol2taw.lnk")) returned 1 [0290.942] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZdPEloNUqMk9Fol2tAW.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zdpelonuqmk9fol2taw.lnk")) returned 0xffffffff [0290.942] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd6b5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623a7720, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623a7720, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd69, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ZJAfbvet QyCOD.lnk", cAlternateFileName="ZJAFBV~1.LNK")) returned 1 [0290.943] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJAfbvet QyCOD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zjafbvet qycod.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0290.943] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJAfbvet QyCOD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zjafbvet qycod.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0290.944] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xd69 [0290.944] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0290.944] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0291.038] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0xd69, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xd69, lpOverlapped=0x0) returned 1 [0291.039] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xd70, lpOverlapped=0x0) returned 1 [0291.040] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0291.099] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0291.110] CloseHandle (hObject=0xf8) returned 1 [0291.110] CloseHandle (hObject=0xe0) returned 1 [0291.110] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJAfbvet QyCOD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zjafbvet qycod.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJAfbvet QyCOD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zjafbvet qycod.lnk.ozq0")) returned 0 [0291.111] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJAfbvet QyCOD.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zjafbvet qycod.lnk.ozq0")) returned 0x20 [0291.111] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJAfbvet QyCOD.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd6b5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623a7720, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623a7720, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd69, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ZJAfbvet QyCOD.lnk", cAlternateFileName="ZJAFBV~1.LNK")) returned 0x277e98 [0291.112] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd6b5c0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x623a7720, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x623a7720, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xd69, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ZJAfbvet QyCOD.lnk", cAlternateFileName="ZJAFBV~1.LNK")) returned 0 [0291.112] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0291.112] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJAfbvet QyCOD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zjafbvet qycod.lnk")) returned 1 [0291.113] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZJAfbvet QyCOD.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zjafbvet qycod.lnk")) returned 0xffffffff [0291.113] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62276c20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62276c20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62276c20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ZN2TdeRQwdCf1I.lnk", cAlternateFileName="ZN2TDE~1.LNK")) returned 1 [0291.113] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZN2TdeRQwdCf1I.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zn2tderqwdcf1i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0291.113] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZN2TdeRQwdCf1I.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zn2tderqwdcf1i.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0291.114] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x9ea [0291.115] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0291.115] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0291.204] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0x9ea, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x9ea, lpOverlapped=0x0) returned 1 [0291.205] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x9f0, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x9f0, lpOverlapped=0x0) returned 1 [0291.206] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0291.273] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0291.284] CloseHandle (hObject=0xe0) returned 1 [0291.284] CloseHandle (hObject=0xf8) returned 1 [0291.285] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZN2TdeRQwdCf1I.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zn2tderqwdcf1i.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZN2TdeRQwdCf1I.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zn2tderqwdcf1i.lnk.ozq0")) returned 0 [0291.285] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZN2TdeRQwdCf1I.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zn2tderqwdcf1i.lnk.ozq0")) returned 0x20 [0291.285] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZN2TdeRQwdCf1I.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62276c20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62276c20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62276c20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ZN2TdeRQwdCf1I.lnk", cAlternateFileName="ZN2TDE~1.LNK")) returned 0x277e98 [0291.286] FindNextFileA (in: hFindFile=0x277e98, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62276c20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62276c20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62276c20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x26dde0, dwReserved1=0x258bd0, cFileName="ZN2TdeRQwdCf1I.lnk", cAlternateFileName="ZN2TDE~1.LNK")) returned 0 [0291.286] FindClose (in: hFindFile=0x277e98 | out: hFindFile=0x277e98) returned 1 [0291.286] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZN2TdeRQwdCf1I.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zn2tderqwdcf1i.lnk")) returned 1 [0291.287] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZN2TdeRQwdCf1I.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zn2tderqwdcf1i.lnk")) returned 0xffffffff [0291.287] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e9a1ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62419b40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62419b40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x935, dwReserved0=0x76f7387a, dwReserved1=0x76653ad5, cFileName="ztrsgyIigY.lnk", cAlternateFileName="ZTRSGY~1.LNK")) returned 1 [0291.287] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztrsgyIigY.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ztrsgyiigy.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0291.287] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztrsgyIigY.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ztrsgyiigy.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0291.288] GetFileSize (in: hFile=0xf8, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0x935 [0291.288] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0291.289] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0291.377] ReadFile (in: hFile=0xf8, lpBuffer=0x299000c, nNumberOfBytesToRead=0x935, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0x935, lpOverlapped=0x0) returned 1 [0291.378] WriteFile (in: hFile=0xe0, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0x940, lpOverlapped=0x0) returned 1 [0291.379] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000) returned 1 [0291.441] VirtualFree (lpAddress=0x2990000, dwSize=0x0, dwFreeType=0x8000) returned 1 [0291.453] CloseHandle (hObject=0xf8) returned 1 [0291.453] CloseHandle (hObject=0xe0) returned 1 [0291.453] MoveFileA (lpExistingFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztrsgyIigY.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ztrsgyiigy.lnk"), lpNewFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztrsgyIigY.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ztrsgyiigy.lnk.ozq0")) returned 0 [0291.454] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztrsgyIigY.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ztrsgyiigy.lnk.ozq0")) returned 0x20 [0291.454] FindFirstFileA (in: lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztrsgyIigY.lnk", lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e9a1ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62419b40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62419b40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x935, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ztrsgyIigY.lnk", cAlternateFileName="ZTRSGY~1.LNK")) returned 0x277df0 [0291.454] FindNextFileA (in: hFindFile=0x277df0, lpFindFileData=0x18ea64 | out: lpFindFileData=0x18ea64*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e9a1ee0, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x62419b40, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x62419b40, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0x935, dwReserved0=0x26e008, dwReserved1=0x258bd0, cFileName="ztrsgyIigY.lnk", cAlternateFileName="ZTRSGY~1.LNK")) returned 0 [0291.454] FindClose (in: hFindFile=0x277df0 | out: hFindFile=0x277df0) returned 1 [0291.454] DeleteFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztrsgyIigY.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ztrsgyiigy.lnk")) returned 1 [0291.455] GetFileAttributesA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ztrsgyIigY.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\ztrsgyiigy.lnk")) returned 0xffffffff [0291.455] FindNextFileA (in: hFindFile=0x26dd88, lpFindFileData=0x18edf0 | out: lpFindFileData=0x18edf0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x612fdd20, ftCreationTime.dwHighDateTime=0x1d82a2c, ftLastAccessTime.dwLowDateTime=0x612fdd20, ftLastAccessTime.dwHighDateTime=0x1d82a2c, ftLastWriteTime.dwLowDateTime=0x612fdd20, ftLastWriteTime.dwHighDateTime=0x1d82a2c, nFileSizeHigh=0x0, nFileSizeLow=0xe5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZUlgRx Jta9i.lnk", cAlternateFileName="ZULGRX~1.LNK")) returned 1 [0291.456] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZUlgRx Jta9i.lnk" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zulgrx jta9i.lnk"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xe0 [0291.456] CreateFileA (lpFileName="C:\\Users\\kEecfMwgj\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ZUlgRx Jta9i.lnk.ozq0" (normalized: "c:\\users\\keecfmwgj\\appdata\\roaming\\microsoft\\windows\\recent\\zulgrx jta9i.lnk.ozq0"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xf8 [0291.457] GetFileSize (in: hFile=0xe0, lpFileSizeHigh=0x0 | out: lpFileSizeHigh=0x0) returned 0xe5b [0291.457] VirtualAlloc (lpAddress=0x0, dwSize=0x510000, flAllocationType=0x2000, flProtect=0x1) returned 0x2990000 [0291.457] VirtualAlloc (lpAddress=0x2990000, dwSize=0x504000, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000 [0291.550] ReadFile (in: hFile=0xe0, lpBuffer=0x299000c, nNumberOfBytesToRead=0xe5b, lpNumberOfBytesRead=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesRead=0x18eb68*=0xe5b, lpOverlapped=0x0) returned 1 [0291.642] WriteFile (in: hFile=0xf8, lpBuffer=0x299000c*, nNumberOfBytesToWrite=0xe60, lpNumberOfBytesWritten=0x18eb68, lpOverlapped=0x0 | out: lpBuffer=0x299000c*, lpNumberOfBytesWritten=0x18eb68*=0xe60, lpOverlapped=0x0) returned 1 [0291.643] VirtualFree (lpAddress=0x2990000, dwSize=0x504000, dwFreeType=0x4000)